{
  "generated_at": "2026-07-18T12:24:06.553884Z",
  "window_hours": 24,
  "threat_index": {
    "value": 77,
    "label": "ELEVATED",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "118K",
    "unique_ips": "6,790",
    "protocols_covered": 7,
    "continents_covered": 3,
    "top_technique": {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 47
    }
  },
  "hourly_volume": [
    2957,
    4032,
    3507,
    6416,
    8120,
    6450,
    8586,
    6272,
    3204,
    4460,
    5247,
    3739,
    2770,
    4345,
    4898,
    3384,
    3089,
    3851,
    4768,
    4168,
    5057,
    4649,
    4820,
    3059
  ],
  "windows": {
    "24h": {
      "events": "112K",
      "volume": [
        2957,
        4032,
        3507,
        6416,
        8120,
        6450,
        8586,
        6272,
        3204,
        4460,
        5247,
        3739,
        2770,
        4345,
        4898,
        3384,
        3089,
        3851,
        4768,
        4168,
        5057,
        4649,
        4820,
        3059
      ],
      "labels": [
        "00:00",
        "01:00",
        "02:00",
        "03:00",
        "04:00",
        "05:00",
        "06:00",
        "07:00",
        "08:00",
        "09:00",
        "10:00",
        "11:00",
        "12:00",
        "13:00",
        "14:00",
        "15:00",
        "16:00",
        "17:00",
        "18:00",
        "19:00",
        "20:00",
        "21:00",
        "22:00",
        "23:00"
      ],
      "unit": "events / hour",
      "protocols": [
        {
          "name": "SCADA-Modbus",
          "pct": 40,
          "amber": true
        },
        {
          "name": "SSL-VPN",
          "pct": 22,
          "amber": false
        },
        {
          "name": "Telnet",
          "pct": 20,
          "amber": false
        },
        {
          "name": "HTTP",
          "pct": 10,
          "amber": false
        },
        {
          "name": "DICOM",
          "pct": 7,
          "amber": false
        }
      ],
      "unique_ips": "1,145",
      "origins": [
        {
          "name": "Germany",
          "pct": 22
        },
        {
          "name": "United States",
          "pct": 14
        },
        {
          "name": "Netherlands",
          "pct": 10
        },
        {
          "name": "China",
          "pct": 7
        },
        {
          "name": "Hong Kong",
          "pct": 6
        },
        {
          "name": "Other",
          "pct": 41
        }
      ],
      "map_origins": [
        {
          "name": "Germany",
          "lat": 51,
          "lon": 10,
          "pct": 22
        },
        {
          "name": "United States",
          "lat": 39,
          "lon": -98,
          "pct": 14
        },
        {
          "name": "Netherlands",
          "lat": 52,
          "lon": 5,
          "pct": 10
        },
        {
          "name": "China",
          "lat": 35,
          "lon": 105,
          "pct": 7
        },
        {
          "name": "Hong Kong",
          "lat": 22,
          "lon": 114,
          "pct": 6
        },
        {
          "name": "United Kingdom",
          "lat": 54,
          "lon": -2,
          "pct": 5
        },
        {
          "name": "Bulgaria",
          "lat": 43,
          "lon": 25,
          "pct": 4
        },
        {
          "name": "Brazil",
          "lat": -10,
          "lon": -52,
          "pct": 4
        },
        {
          "name": "Vietnam",
          "lat": 16,
          "lon": 108,
          "pct": 4
        },
        {
          "name": "South Korea",
          "lat": 37,
          "lon": 128,
          "pct": 3
        },
        {
          "name": "Indonesia",
          "lat": -2,
          "lon": 118,
          "pct": 3
        },
        {
          "name": "Turkey",
          "lat": 39,
          "lon": 35,
          "pct": 2
        }
      ]
    },
    "7d": {
      "events": "2.5M",
      "volume": [
        411829,
        509335,
        606588,
        627856,
        157174,
        151368,
        73769
      ],
      "labels": [
        "07-12",
        "07-13",
        "07-14",
        "07-15",
        "07-16",
        "07-17",
        "07-18"
      ],
      "unit": "events / day",
      "protocols": [
        {
          "name": "Telnet",
          "pct": 37,
          "amber": false
        },
        {
          "name": "SCADA-Modbus",
          "pct": 25,
          "amber": true
        },
        {
          "name": "SSH",
          "pct": 16,
          "amber": false
        },
        {
          "name": "SSL-VPN",
          "pct": 11,
          "amber": false
        },
        {
          "name": "HTTP",
          "pct": 6,
          "amber": false
        },
        {
          "name": "DICOM",
          "pct": 4,
          "amber": false
        }
      ],
      "origins": [
        {
          "name": "Netherlands",
          "pct": 55
        },
        {
          "name": "United States",
          "pct": 11
        },
        {
          "name": "Poland",
          "pct": 7
        },
        {
          "name": "United Kingdom",
          "pct": 5
        },
        {
          "name": "China",
          "pct": 4
        },
        {
          "name": "Other",
          "pct": 18
        }
      ],
      "map_origins": [
        {
          "name": "Netherlands",
          "lat": 52,
          "lon": 5,
          "pct": 55
        },
        {
          "name": "United States",
          "lat": 39,
          "lon": -98,
          "pct": 11
        },
        {
          "name": "Poland",
          "lat": 52,
          "lon": 19,
          "pct": 7
        },
        {
          "name": "United Kingdom",
          "lat": 54,
          "lon": -2,
          "pct": 5
        },
        {
          "name": "China",
          "lat": 35,
          "lon": 105,
          "pct": 4
        },
        {
          "name": "Bulgaria",
          "lat": 43,
          "lon": 25,
          "pct": 3
        },
        {
          "name": "Hong Kong",
          "lat": 22,
          "lon": 114,
          "pct": 3
        },
        {
          "name": "Singapore",
          "lat": 1,
          "lon": 104,
          "pct": 2
        },
        {
          "name": "France",
          "lat": 46,
          "lon": 2,
          "pct": 2
        },
        {
          "name": "Colombia",
          "lat": 4,
          "lon": -72,
          "pct": 2
        },
        {
          "name": "South Korea",
          "lat": 37,
          "lon": 128,
          "pct": 2
        },
        {
          "name": "Germany",
          "lat": 51,
          "lon": 10,
          "pct": 2
        }
      ],
      "unique_ips": "9,037"
    },
    "18d": {
      "events": "4.7M",
      "volume": [
        54355,
        41648,
        110635,
        46783,
        45005,
        173523,
        201059,
        220838,
        320951,
        386989,
        574934,
        411829,
        509335,
        606588,
        627856,
        157174,
        151368,
        73769
      ],
      "labels": [
        "07-01",
        "07-02",
        "07-03",
        "07-04",
        "07-05",
        "07-06",
        "07-07",
        "07-08",
        "07-09",
        "07-10",
        "07-11",
        "07-12",
        "07-13",
        "07-14",
        "07-15",
        "07-16",
        "07-17",
        "07-18"
      ],
      "unit": "events / day",
      "protocols": [
        {
          "name": "Telnet",
          "pct": 31,
          "amber": false
        },
        {
          "name": "SCADA-Modbus",
          "pct": 30,
          "amber": true
        },
        {
          "name": "SSH",
          "pct": 20,
          "amber": false
        },
        {
          "name": "SSL-VPN",
          "pct": 10,
          "amber": false
        },
        {
          "name": "HTTP",
          "pct": 5,
          "amber": false
        },
        {
          "name": "DICOM",
          "pct": 4,
          "amber": false
        }
      ],
      "origins": [
        {
          "name": "Netherlands",
          "pct": 55
        },
        {
          "name": "United States",
          "pct": 12
        },
        {
          "name": "Poland",
          "pct": 7
        },
        {
          "name": "United Kingdom",
          "pct": 5
        },
        {
          "name": "China",
          "pct": 4
        },
        {
          "name": "Other",
          "pct": 17
        }
      ],
      "map_origins": [
        {
          "name": "Netherlands",
          "lat": 52,
          "lon": 5,
          "pct": 55
        },
        {
          "name": "United States",
          "lat": 39,
          "lon": -98,
          "pct": 12
        },
        {
          "name": "Poland",
          "lat": 52,
          "lon": 19,
          "pct": 7
        },
        {
          "name": "United Kingdom",
          "lat": 54,
          "lon": -2,
          "pct": 5
        },
        {
          "name": "China",
          "lat": 35,
          "lon": 105,
          "pct": 4
        },
        {
          "name": "Bulgaria",
          "lat": 43,
          "lon": 25,
          "pct": 3
        },
        {
          "name": "Hong Kong",
          "lat": 22,
          "lon": 114,
          "pct": 2
        },
        {
          "name": "Singapore",
          "lat": 1,
          "lon": 104,
          "pct": 2
        },
        {
          "name": "France",
          "lat": 46,
          "lon": 2,
          "pct": 2
        },
        {
          "name": "Colombia",
          "lat": 4,
          "lon": -72,
          "pct": 2
        },
        {
          "name": "South Korea",
          "lat": 37,
          "lon": 128,
          "pct": 2
        },
        {
          "name": "Germany",
          "lat": 51,
          "lon": 10,
          "pct": 2
        }
      ],
      "unique_ips": "9,488"
    }
  },
  "origins": [
    {
      "name": "Germany",
      "pct": 22
    },
    {
      "name": "United States",
      "pct": 14
    },
    {
      "name": "Netherlands",
      "pct": 10
    },
    {
      "name": "China",
      "pct": 7
    },
    {
      "name": "Hong Kong",
      "pct": 6
    },
    {
      "name": "Other",
      "pct": 41
    }
  ],
  "protocols": [
    {
      "name": "SCADA-Modbus",
      "pct": 40,
      "amber": true
    },
    {
      "name": "SSL-VPN",
      "pct": 22,
      "amber": false
    },
    {
      "name": "Telnet",
      "pct": 20,
      "amber": false
    },
    {
      "name": "HTTP",
      "pct": 10,
      "amber": false
    },
    {
      "name": "DICOM",
      "pct": 7,
      "amber": false
    }
  ],
  "credentials": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34",
      "count": 264,
      "app": "Linux / SSH server"
    },
    {
      "user": "admin",
      "pass": "admin",
      "count": 106,
      "app": "Linux / SSH server"
    },
    {
      "user": "root",
      "pass": "3245gs5662d34",
      "count": 99,
      "app": "Linux / SSH server"
    },
    {
      "user": "root",
      "pass": "root123",
      "count": 98,
      "app": "Telnet / IoT device"
    },
    {
      "user": "root",
      "pass": "root",
      "count": 86,
      "app": "Telnet / IoT device"
    },
    {
      "user": "root",
      "pass": "checking!@!@%",
      "count": 72,
      "app": "Linux / SSH server"
    }
  ],
  "credentials_by_appliance": {
    "Auth / IdP appliance": [
      {
        "user": "admin",
        "pass": "admin",
        "count": 3
      },
      {
        "user": "root",
        "pass": "1234",
        "count": 3
      },
      {
        "user": "root",
        "pass": "123456",
        "count": 3
      },
      {
        "user": "admin",
        "pass": "admin123",
        "count": 3
      },
      {
        "user": "root",
        "pass": "checking!@!@%",
        "count": 2
      },
      {
        "user": "root",
        "pass": "Forten1883",
        "count": 2
      }
    ],
    "Building management (BMS)": [
      {
        "user": "root",
        "pass": "checking!@!@%",
        "count": 2
      },
      {
        "user": "root",
        "pass": "Forten1883",
        "count": 2
      },
      {
        "user": "test",
        "pass": "test2023",
        "count": 2
      },
      {
        "user": "root",
        "pass": "qwert@123",
        "count": 2
      },
      {
        "user": "deploy",
        "pass": "deploy@2024",
        "count": 2
      },
      {
        "user": "root",
        "pass": "Cloud12#$",
        "count": 2
      }
    ],
    "Linux / SSH server": [
      {
        "user": "345gs5662d34",
        "pass": "345gs5662d34",
        "count": 188
      },
      {
        "user": "root",
        "pass": "3245gs5662d34",
        "count": 70
      },
      {
        "user": "admin",
        "pass": "admin",
        "count": 41
      },
      {
        "user": "root",
        "pass": "checking!@!@%",
        "count": 38
      },
      {
        "user": "debian",
        "pass": "temppwd",
        "count": 29
      },
      {
        "user": "root",
        "pass": "Forten1883",
        "count": 16
      }
    ],
    "Network switch": [
      {
        "user": "admin",
        "pass": "admin",
        "count": 5
      }
    ],
    "Serial console server": [
      {
        "user": "345gs5662d34",
        "pass": "345gs5662d34",
        "count": 33
      },
      {
        "user": "root",
        "pass": "3245gs5662d34",
        "count": 13
      },
      {
        "user": "support",
        "pass": "123456",
        "count": 12
      },
      {
        "user": "root",
        "pass": "checking!@!@%",
        "count": 11
      },
      {
        "user": "root",
        "pass": "Forten1883",
        "count": 5
      },
      {
        "user": "webmaster",
        "pass": "webmaster",
        "count": 2
      }
    ],
    "Solar inverter": [
      {
        "user": "admin",
        "pass": "admin",
        "count": 4
      },
      {
        "user": "ubuntu",
        "pass": "123456789",
        "count": 3
      },
      {
        "user": "user002",
        "pass": "user002123",
        "count": 3
      },
      {
        "user": "user",
        "pass": "1234qwer",
        "count": 3
      },
      {
        "user": "root",
        "pass": "Password!!",
        "count": 3
      },
      {
        "user": "root",
        "pass": "Qwerty123456",
        "count": 3
      }
    ],
    "Telnet / IoT device": [
      {
        "user": "root",
        "pass": "root123",
        "count": 80
      },
      {
        "user": "root",
        "pass": "root",
        "count": 64
      },
      {
        "user": "user",
        "pass": "user",
        "count": 54
      },
      {
        "user": "support",
        "pass": "support",
        "count": 52
      },
      {
        "user": "root",
        "pass": "123456",
        "count": 46
      },
      {
        "user": "ftp",
        "pass": "ftp",
        "count": 42
      }
    ],
    "UPS / power controller": [
      {
        "user": "345gs5662d34",
        "pass": "345gs5662d34",
        "count": 43
      },
      {
        "user": "root",
        "pass": "checking!@!@%",
        "count": 17
      },
      {
        "user": "root",
        "pass": "3245gs5662d34",
        "count": 16
      },
      {
        "user": "admin",
        "pass": "admin",
        "count": 8
      },
      {
        "user": "ubuntu",
        "pass": "3245gs5662d34",
        "count": 4
      },
      {
        "user": "root",
        "pass": "Forten1883",
        "count": 3
      }
    ],
    "Water SCADA / PLC": [
      {
        "user": "admin",
        "pass": "admin",
        "count": 4
      },
      {
        "user": "git",
        "pass": "123",
        "count": 3
      },
      {
        "user": "root",
        "pass": "checking!@!@%",
        "count": 2
      },
      {
        "user": "demo",
        "pass": "demo",
        "count": 2
      },
      {
        "user": "root",
        "pass": "1234",
        "count": 2
      },
      {
        "user": "root",
        "pass": "12345",
        "count": 2
      }
    ]
  },
  "mitre_observed": {
    "window": "24h",
    "enterprise": {
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "count": 4264
      },
      "T1110": {
        "name": "Brute Force",
        "count": 3356
      },
      "T1059": {
        "name": "Command & Scripting Interpreter",
        "count": 1144
      },
      "T1082": {
        "name": "System Information Discovery",
        "count": 262
      },
      "T1105": {
        "name": "Ingress Tool Transfer",
        "count": 39
      },
      "T1071": {
        "name": "Application Layer Protocol (C2)",
        "count": 17
      }
    },
    "ics": {
      "T0846": {
        "name": "Remote System Discovery",
        "count": 2823
      },
      "T0861": {
        "name": "Point & Tag Identification",
        "count": 1047
      },
      "T0801": {
        "name": "Monitoring Process State",
        "count": 1047
      },
      "T0888": {
        "name": "System Firmware",
        "count": 1029
      },
      "T0886": {
        "name": "Remote Services",
        "count": 1029
      },
      "T0812": {
        "name": "Default Credentials",
        "count": 661
      },
      "T0842": {
        "name": "Network Sniffing",
        "count": 431
      }
    }
  },
  "mitre": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 47
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "pct": 37
    },
    {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 13
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "pct": 3
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "pct": 0
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol (C2)",
      "pct": 0
    }
  ],
  "map_origins": [
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 22
    },
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 14
    },
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 10
    },
    {
      "name": "China",
      "lat": 35,
      "lon": 105,
      "pct": 7
    },
    {
      "name": "Hong Kong",
      "lat": 22,
      "lon": 114,
      "pct": 6
    },
    {
      "name": "United Kingdom",
      "lat": 54,
      "lon": -2,
      "pct": 5
    },
    {
      "name": "Bulgaria",
      "lat": 43,
      "lon": 25,
      "pct": 4
    },
    {
      "name": "Brazil",
      "lat": -10,
      "lon": -52,
      "pct": 4
    },
    {
      "name": "Vietnam",
      "lat": 16,
      "lon": 108,
      "pct": 4
    },
    {
      "name": "South Korea",
      "lat": 37,
      "lon": 128,
      "pct": 3
    },
    {
      "name": "Indonesia",
      "lat": -2,
      "lon": 118,
      "pct": 3
    },
    {
      "name": "Turkey",
      "lat": 39,
      "lon": 35,
      "pct": 2
    }
  ],
  "feed": [
    {
      "proto": "SSH",
      "origin": "HK",
      "act": "hands-on session, 9 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "NL",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Agentic Attacker",
      "ac": "#FFB800"
    },
    {
      "proto": "SSH",
      "origin": "BR",
      "act": "hands-on session, 6 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "HK",
      "act": "hands-on session, 25 commands",
      "arch": "Agentic Attacker",
      "ac": "#FFB800"
    },
    {
      "proto": "HTTP",
      "origin": "GB",
      "act": "Barracuda/SCALANCE login attempt, 3 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "Barracuda/SCALANCE login attempt, 1 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "CN",
      "act": "credential spray, 12 attempts",
      "arch": "Credential-Spray Bot",
      "ac": "#00D4AA"
    },
    {
      "proto": "HTTP",
      "origin": "BR",
      "act": "Barracuda/SCALANCE login attempt, 12 tries",
      "arch": "Credential-Spray Bot",
      "ac": "#00D4AA"
    }
  ],
  "nuisance_filtered": 7308,
  "captures": {
    "window_days": 10,
    "events": 1179225,
    "sessions": 353132,
    "unique_ips": 6790,
    "per_day": 117922,
    "per_week": 825458,
    "per_month": 3537675,
    "alltime_estimate": 27270079,
    "alltime_floor": 27000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.",
  "canary": {
    "updated_at": "2026-07-18T12:24:04Z",
    "tokens_planted": 1506,
    "bait_grab_ips": 69,
    "detonations_total": 27,
    "detonation_ips": 13,
    "incidents_total": 16,
    "incidents_cross_ip_reuse": 11,
    "recent_detonations": [
      {
        "ts": "2026-07-16T16:51:55Z",
        "geo": "SG",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.156.x.x"
      },
      {
        "ts": "2026-07-11T17:27:23Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.159.x.x"
      },
      {
        "ts": "2026-07-11T17:13:31Z",
        "geo": "BR",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.157.x.x"
      },
      {
        "ts": "2026-07-11T14:23:55Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "170.106.x.x"
      },
      {
        "ts": "2026-07-11T02:26:36Z",
        "geo": "NL",
        "asn": "AS48090",
        "flavor": "http",
        "ua_class": "tool/scanner",
        "ip_redacted": "195.178.x.x"
      }
    ]
  }
}