{
  "generated_at": "2026-07-12T14:54:11.162060Z",
  "window_hours": 24,
  "threat_index": {
    "value": 71,
    "label": "ELEVATED",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "232K",
    "unique_ips": "13,315",
    "protocols_covered": 3,
    "continents_covered": 2,
    "top_technique": {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 37
    }
  },
  "hourly_volume": [
    560,
    419,
    399,
    406,
    528,
    394,
    415,
    486,
    476,
    437,
    377,
    427,
    439,
    459,
    452,
    407,
    583,
    445,
    474,
    4538,
    8372,
    10916,
    13449,
    19312
  ],
  "origins": [
    {
      "name": "The Netherlands",
      "pct": 29
    },
    {
      "name": "United States",
      "pct": 11
    },
    {
      "name": "United Kingdom",
      "pct": 9
    },
    {
      "name": "Germany",
      "pct": 6
    },
    {
      "name": "Bulgaria",
      "pct": 6
    },
    {
      "name": "Other",
      "pct": 39
    }
  ],
  "protocols": [
    {
      "name": "SSH",
      "pct": 79,
      "amber": false
    },
    {
      "name": "HTTP",
      "pct": 18,
      "amber": false
    },
    {
      "name": "SCADA-Modbus",
      "pct": 3,
      "amber": true
    }
  ],
  "credentials": [
    {
      "user": "admin",
      "pass": "admin",
      "count": 193
    },
    {
      "user": "support",
      "pass": "support",
      "count": 151
    },
    {
      "user": "user",
      "pass": "user",
      "count": 109
    },
    {
      "user": "root",
      "pass": "12345",
      "count": 102
    },
    {
      "user": "root",
      "pass": "root123",
      "count": 96
    },
    {
      "user": "root",
      "pass": "root",
      "count": 86
    }
  ],
  "mitre": [
    {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 37
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 28
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "pct": 26
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "pct": 8
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "pct": 2
    },
    {
      "id": "T1003",
      "name": "OS Credential Dumping",
      "pct": 0
    }
  ],
  "map_origins": [
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 11
    },
    {
      "name": "United Kingdom",
      "lat": 54,
      "lon": -2,
      "pct": 9
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 6
    },
    {
      "name": "Bulgaria",
      "lat": 43,
      "lon": 25,
      "pct": 6
    }
  ],
  "feed": [
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "path-permutation scan, config/.env harvest",
      "arch": "Web Exploit Scanner",
      "ac": "#94A3B8"
    },
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "path-permutation scan, config/.env harvest",
      "arch": "Web Exploit Scanner",
      "ac": "#94A3B8"
    },
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "path-permutation scan, config/.env harvest",
      "arch": "Web Exploit Scanner",
      "ac": "#94A3B8"
    },
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "path-permutation scan, config/.env harvest",
      "arch": "Web Exploit Scanner",
      "ac": "#94A3B8"
    },
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "path-permutation scan, config/.env harvest",
      "arch": "Web Exploit Scanner",
      "ac": "#94A3B8"
    },
    {
      "proto": "HTTP",
      "origin": "\u2014",
      "act": "path-permutation scan, config/.env harvest",
      "arch": "Web Exploit Scanner",
      "ac": "#94A3B8"
    }
  ],
  "nuisance_filtered": 468,
  "captures": {
    "window_days": 16,
    "events": 3712062,
    "sessions": 1000179,
    "unique_ips": 13315,
    "per_day": 232004,
    "per_week": 1624027,
    "per_month": 6960116,
    "alltime_estimate": 26112062,
    "alltime_floor": 26000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 24h and redacted."
}