{
  "generated_at": "2026-07-15T18:45:35.265330Z",
  "window_hours": 24,
  "threat_index": {
    "value": 84,
    "label": "ELEVATED",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "150K",
    "unique_ips": "6,346",
    "protocols_covered": 7,
    "continents_covered": 2,
    "top_technique": {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 36
    }
  },
  "hourly_volume": [
    4915,
    6708,
    4088,
    6166,
    4016,
    3226,
    2396,
    1858,
    1636,
    4240,
    3488,
    3145,
    1540,
    1876,
    2682,
    2020,
    4285,
    2654,
    2297,
    6517,
    4845,
    3306,
    2914,
    1155
  ],
  "windows": {
    "24h": {
      "events": "82K",
      "unique_ips": "1,172",
      "volume": [
        4915,
        6708,
        4088,
        6166,
        4016,
        3226,
        2396,
        1858,
        1636,
        4240,
        3488,
        3145,
        1540,
        1876,
        2682,
        2020,
        4285,
        2654,
        2297,
        6517,
        4845,
        3306,
        2914,
        1155
      ],
      "labels": [
        "00:00",
        "01:00",
        "02:00",
        "03:00",
        "04:00",
        "05:00",
        "06:00",
        "07:00",
        "08:00",
        "09:00",
        "10:00",
        "11:00",
        "12:00",
        "13:00",
        "14:00",
        "15:00",
        "16:00",
        "17:00",
        "18:00",
        "19:00",
        "20:00",
        "21:00",
        "22:00",
        "23:00"
      ],
      "unit": "events / hour"
    },
    "7d": {
      "events": "2.8M",
      "unique_ips": "18,160",
      "volume": [
        320951,
        386989,
        574934,
        411829,
        509335,
        554342,
        84820
      ],
      "labels": [
        "07-09",
        "07-10",
        "07-11",
        "07-12",
        "07-13",
        "07-14",
        "07-15"
      ],
      "unit": "events / day"
    },
    "18d": {
      "events": "3.9M",
      "unique_ips": "29,109",
      "volume": [
        40992,
        48660,
        51517,
        54355,
        41648,
        110635,
        46783,
        45005,
        173523,
        201059,
        220838,
        320951,
        386989,
        574934,
        411829,
        509335,
        554342,
        84820
      ],
      "labels": [
        "06-28",
        "06-29",
        "06-30",
        "07-01",
        "07-02",
        "07-03",
        "07-04",
        "07-05",
        "07-06",
        "07-07",
        "07-08",
        "07-09",
        "07-10",
        "07-11",
        "07-12",
        "07-13",
        "07-14",
        "07-15"
      ],
      "unit": "events / day"
    }
  },
  "origins": [
    {
      "name": "Netherlands",
      "pct": 22
    },
    {
      "name": "United States",
      "pct": 18
    },
    {
      "name": "Germany",
      "pct": 12
    },
    {
      "name": "United Kingdom",
      "pct": 5
    },
    {
      "name": "Mexico",
      "pct": 5
    },
    {
      "name": "Other",
      "pct": 38
    }
  ],
  "protocols": [
    {
      "name": "SSL-VPN",
      "pct": 31,
      "amber": false
    },
    {
      "name": "HTTP",
      "pct": 22,
      "amber": false
    },
    {
      "name": "DICOM",
      "pct": 17,
      "amber": false
    },
    {
      "name": "Telnet",
      "pct": 15,
      "amber": false
    },
    {
      "name": "SCADA-Modbus",
      "pct": 11,
      "amber": true
    },
    {
      "name": "SSH",
      "pct": 4,
      "amber": false
    }
  ],
  "credentials": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34",
      "count": 123
    },
    {
      "user": "admin",
      "pass": "admin",
      "count": 118
    },
    {
      "user": "root",
      "pass": "root",
      "count": 105
    },
    {
      "user": "chronos",
      "pass": "facepunch",
      "count": 91
    },
    {
      "user": "root",
      "pass": "12345",
      "count": 88
    },
    {
      "user": "root",
      "pass": "root123",
      "count": 73
    }
  ],
  "mitre": [
    {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 36
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "pct": 35
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 26
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "pct": 3
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "pct": 1
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol (C2)",
      "pct": 0
    }
  ],
  "map_origins": [
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 22
    },
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 18
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 12
    },
    {
      "name": "United Kingdom",
      "lat": 54,
      "lon": -2,
      "pct": 5
    },
    {
      "name": "Mexico",
      "lat": 23,
      "lon": -102,
      "pct": 5
    },
    {
      "name": "France",
      "lat": 46,
      "lon": 2,
      "pct": 4
    },
    {
      "name": "Singapore",
      "lat": 1,
      "lon": 104,
      "pct": 4
    },
    {
      "name": "Vietnam",
      "lat": 16,
      "lon": 108,
      "pct": 3
    },
    {
      "name": "Hong Kong",
      "lat": 22,
      "lon": 114,
      "pct": 2
    },
    {
      "name": "China",
      "lat": 35,
      "lon": 105,
      "pct": 2
    },
    {
      "name": "Brazil",
      "lat": -10,
      "lon": -52,
      "pct": 2
    }
  ],
  "feed": [
    {
      "proto": "SSH",
      "origin": "SG",
      "act": "1 auth attempts, 5 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "NL",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Agentic Attacker",
      "ac": "#FFB800"
    },
    {
      "proto": "SSH",
      "origin": "VN",
      "act": "hands-on session, 9 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "LY",
      "act": "recon then credential-store read",
      "arch": "Agentic Attacker",
      "ac": "#FFB800"
    },
    {
      "proto": "HTTP",
      "origin": "HK",
      "act": "Barracuda/SCALANCE login attempt, 1 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "PL",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Mirai / IoT Botnet",
      "ac": "#00D4AA"
    },
    {
      "proto": "HTTP",
      "origin": "GB",
      "act": "Barracuda/SCALANCE login attempt, 7 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "MODBUS",
      "origin": "DE",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Mirai / IoT Botnet",
      "ac": "#00D4AA"
    }
  ],
  "nuisance_filtered": 8405,
  "captures": {
    "window_days": 9,
    "events": 1346209,
    "sessions": 358920,
    "unique_ips": 6346,
    "per_day": 149579,
    "per_week": 1047051,
    "per_month": 4487363,
    "alltime_estimate": 26292486,
    "alltime_floor": 26000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.",
  "canary": {
    "updated_at": "2026-07-15T18:22:01Z",
    "tokens_planted": 290,
    "bait_grab_ips": 24,
    "detonations_total": 11,
    "detonation_ips": 4,
    "incidents_total": 8,
    "incidents_cross_ip_reuse": 3,
    "recent_detonations": [
      {
        "ts": "2026-07-11T17:27:23Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.159.x.x"
      },
      {
        "ts": "2026-07-11T17:13:31Z",
        "geo": "BR",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.157.x.x"
      },
      {
        "ts": "2026-07-11T14:23:55Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "170.106.x.x"
      },
      {
        "ts": "2026-07-11T02:26:36Z",
        "geo": "NL",
        "asn": "AS48090",
        "flavor": "http",
        "ua_class": "tool/scanner",
        "ip_redacted": "195.178.x.x"
      }
    ]
  }
}