{ "generated_at": "2026-08-07T00:25:41.917913Z", "window_hours": 24, "threat_index": { "value": 50, "label": "GUARDED", "ratio_to_normal": 0.54, "baseline_events_per_day": 1440383, "basis": "last 24h volume against the median of the previous 14 complete days, plus observed high-severity techniques and hands-on activity" }, "kpis": { "events": "933K", "unique_ips": "16,824", "protocols_covered": 21, "continents_covered": 6, "top_technique": { "id": "T1110", "name": "Brute Force", "pct": 37 } }, "hourly_volume": [ 15159, 18617, 19473, 5658, 8722, 6202, 8442, 7570, 11515, 7728, 5093, 5143, 14369, 20896, 6555, 9400, 6543, 8616, 15734, 4662, 4691, 5977, 7362, 6318 ], "windows": { "24h": { "events": "780K", "volume": [ 15159, 18617, 19473, 5658, 8722, 6202, 8442, 7570, 11515, 7728, 5093, 5143, 14369, 20896, 6555, 9400, 6543, 8616, 15734, 4662, 4691, 5977, 7362, 6318 ], "labels": [ "00:00", "01:00", "02:00", "03:00", "04:00", "05:00", "06:00", "07:00", "08:00", "09:00", "10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00", "17:00", "18:00", "19:00", "20:00", "21:00", "22:00", "23:00" ], "unit": "events / hour", "protocols": [ { "name": "RDP", "pct": 48, "amber": false }, { "name": "SCADA-Modbus", "pct": 21, "amber": true }, { "name": "SSL-VPN", "pct": 9, "amber": false }, { "name": "DICOM", "pct": 7, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "Telnet", "pct": 6, "amber": false }, { "name": "WATER", "pct": 3, "amber": false }, { "name": "Other", "pct": 1, "amber": false, "includes": [ "DNP3", "ATG-TLS", "GE-SRTP", "BACnet", "EtherNet/IP", "SSH", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "unique_ips": "2,330", "origins": [ { "name": "United States", "pct": 41 }, { "name": "Germany", "pct": 9 }, { "name": "United Kingdom", "pct": 8 }, { "name": "Netherlands", "pct": 5 }, { "name": "China", "pct": 4 }, { "name": "Singapore", "pct": 3 }, { "name": "France", "pct": 3 }, { "name": "Other", "pct": 27 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 41 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 9 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 8 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 5 }, { "name": "China", "lat": 35, "lon": 105, "pct": 4 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 3 }, { "name": "France", "lat": 46, "lon": 2, "pct": 3 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "Canada", "lat": 56, "lon": -106, "pct": 2 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 2 }, { "name": "Saudi Arabia", "lat": 24, "lon": 45, "pct": 2 } ], "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 37 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 23 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 21 }, { "id": "T1021", "name": "Remote Services", "pct": 17 }, { "id": "T1082", "name": "System Information Discovery", "pct": 1 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 }, { "id": "T1210", "name": "Exploitation of Remote Services", "pct": 0 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 0 } ], "mitre_observed": { "window": "24h", "enterprise": { "T1110": { "name": "Brute Force", "count": 3013 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 1881 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 1709 }, "T1021": { "name": "Remote Services", "count": 1377 }, "T1082": { "name": "System Information Discovery", "count": 89 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 12 }, "T1210": { "name": "Exploitation of Remote Services", "count": 3 }, "T1105": { "name": "Ingress Tool Transfer", "count": 1 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 1850 }, "T0861": { "name": "Point & Tag Identification", "count": 898 }, "T0801": { "name": "Monitoring Process State", "count": 898 }, "T0842": { "name": "Network Sniffing", "count": 806 }, "T0886": { "name": "Remote Services", "count": 413 }, "T0888": { "name": "System Firmware", "count": 233 }, "T0812": { "name": "Default Credentials", "count": 97 } } } }, "7d": { "events": "6.9M", "volume": [ 1782571, 1426248, 1052996, 955347, 887835, 789795, 4369 ], "labels": [ "08-01", "08-02", "08-03", "08-04", "08-05", "08-06", "08-07" ], "unit": "events / day", "protocols": [ { "name": "RDP", "pct": 37, "amber": false }, { "name": "SCADA-Modbus", "pct": 24, "amber": true }, { "name": "SSL-VPN", "pct": 12, "amber": false }, { "name": "Telnet", "pct": 7, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "SSH", "pct": 6, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 44 }, { "name": "United Kingdom", "pct": 12 }, { "name": "Indonesia", "pct": 7 }, { "name": "Bulgaria", "pct": 7 }, { "name": "United States", "pct": 6 }, { "name": "India", "pct": 4 }, { "name": "Hong Kong", "pct": 3 }, { "name": "Other", "pct": 17 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 44 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 12 }, { "name": "Indonesia", "lat": -2, "lon": 118, "pct": 7 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 7 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 6 }, { "name": "India", "lat": 21, "lon": 78, "pct": 4 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 3 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 3 }, { "name": "China", "lat": 35, "lon": 105, "pct": 3 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 2 }, { "name": "Taiwan", "lat": 24, "lon": 121, "pct": 2 }, { "name": "Mexico", "lat": 23, "lon": -102, "pct": 1 } ], "unique_ips": "16,100", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 47 }, { "id": "T1021", "name": "Remote Services", "pct": 38 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 3 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 2 }, { "id": "T0801", "name": "Monitoring Process State", "pct": 2 }, { "id": "T0861", "name": "Point & Tag Identification", "pct": 2 }, { "id": "T0842", "name": "Network Sniffing", "pct": 2 } ], "mitre_observed": { "window": "win", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 7511 }, "T1110": { "name": "Brute Force", "count": 177793 }, "T1078": { "name": "Valid Accounts", "count": 5272 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 11818 }, "T1021": { "name": "Remote Services", "count": 145404 }, "T1210": { "name": "Exploitation of Remote Services", "count": 996 }, "T1187": { "name": "Forced Authentication", "count": 3 }, "T1087": { "name": "Account Discovery", "count": 508 } }, "ics": { "T0801": { "name": "Monitoring Process State", "count": 6370 }, "T0861": { "name": "Point & Tag Identification", "count": 6157 }, "T0846": { "name": "Remote System Discovery", "count": 14287 }, "T0842": { "name": "Network Sniffing", "count": 6140 }, "T0812": { "name": "Default Credentials", "count": 53 } } } }, "18d": { "events": "24.8M", "volume": [ 1251114, 1104222, 1232091, 2328340, 2332642, 1380873, 1373574, 1918083, 1781522, 1454518, 1703235, 1782571, 1426248, 1052996, 955347, 887835, 789795, 4369 ], "labels": [ "07-21", "07-22", "07-23", "07-24", "07-25", "07-26", "07-27", "07-28", "07-29", "07-30", "07-31", "08-01", "08-02", "08-03", "08-04", "08-05", "08-06", "08-07" ], "unit": "events / day", "protocols": [ { "name": "RDP", "pct": 32, "amber": false }, { "name": "SCADA-Modbus", "pct": 25, "amber": true }, { "name": "SSL-VPN", "pct": 13, "amber": false }, { "name": "SSH", "pct": 10, "amber": false }, { "name": "Telnet", "pct": 7, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 39 }, { "name": "China", "pct": 12 }, { "name": "United Kingdom", "pct": 8 }, { "name": "Indonesia", "pct": 8 }, { "name": "United States", "pct": 5 }, { "name": "India", "pct": 5 }, { "name": "Bulgaria", "pct": 5 }, { "name": "Other", "pct": 18 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 39 }, { "name": "China", "lat": 35, "lon": 105, "pct": 12 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 8 }, { "name": "Indonesia", "lat": -2, "lon": 118, "pct": 8 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 5 }, { "name": "India", "lat": 21, "lon": 78, "pct": 5 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 5 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 3 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 3 }, { "name": "Mexico", "lat": 23, "lon": -102, "pct": 2 }, { "name": "Egypt", "lat": 26, "lon": 30, "pct": 2 }, { "name": "Italy", "lat": 42, "lon": 12, "pct": 2 } ], "unique_ips": "31,848", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 44 }, { "id": "T1021", "name": "Remote Services", "pct": 36 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 4 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 3 }, { "id": "T0842", "name": "Network Sniffing", "pct": 2 }, { "id": "T1078", "name": "Valid Accounts", "pct": 2 }, { "id": "T0801", "name": "Monitoring Process State", "pct": 1 } ], "mitre_observed": { "window": "win", "enterprise": { "T1110": { "name": "Brute Force", "count": 458015 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 37281 }, "T1078": { "name": "Valid Accounts", "count": 19894 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 34965 }, "T1021": { "name": "Remote Services", "count": 375717 }, "T1087": { "name": "Account Discovery", "count": 1584 }, "T1210": { "name": "Exploitation of Remote Services", "count": 2863 }, "T1187": { "name": "Forced Authentication", "count": 45 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 41915 }, "T0812": { "name": "Default Credentials", "count": 9124 }, "T0801": { "name": "Monitoring Process State", "count": 14792 }, "T0861": { "name": "Point & Tag Identification", "count": 13876 }, "T0842": { "name": "Network Sniffing", "count": 22108 } } } } }, "origins": [ { "name": "United States", "pct": 41 }, { "name": "Germany", "pct": 9 }, { "name": "United Kingdom", "pct": 8 }, { "name": "Netherlands", "pct": 5 }, { "name": "China", "pct": 4 }, { "name": "Singapore", "pct": 3 }, { "name": "France", "pct": 3 }, { "name": "Other", "pct": 27 } ], "protocols": [ { "name": "RDP", "pct": 48, "amber": false }, { "name": "SCADA-Modbus", "pct": 21, "amber": true }, { "name": "SSL-VPN", "pct": 9, "amber": false }, { "name": "DICOM", "pct": 7, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "Telnet", "pct": 6, "amber": false }, { "name": "WATER", "pct": 3, "amber": false }, { "name": "Other", "pct": 1, "amber": false, "includes": [ "DNP3", "ATG-TLS", "GE-SRTP", "BACnet", "EtherNet/IP", "SSH", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "credentials": [ { "user": "user", "pass": "admin2023!", "count": 94, "app": "Linux / SSH server" }, { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 68, "app": "Linux / SSH server" }, { "user": "root", "pass": "3245gs5662d34", "count": 34, "app": "Linux / SSH server" }, { "user": "root", "pass": "checking!@!@%", "count": 25, "app": "Linux / SSH server" }, { "user": "admin", "pass": "admin", "count": 23, "app": "Linux / SSH server" }, { "user": "debian", "pass": "temppwd", "count": 12, "app": "Linux / SSH server" } ], "credentials_by_appliance": { "Auth / IdP appliance": [ { "user": "root", "pass": "checking!@!@%", "count": 4 }, { "user": "root", "pass": "12345", "count": 2 }, { "user": "guest", "pass": "abc123", "count": 2 }, { "user": "root", "pass": "123456789", "count": 2 }, { "user": "admin", "pass": "admin", "count": 2 }, { "user": "admin", "pass": "123123", "count": 2 } ], "Linux / SSH server": [ { "user": "user", "pass": "admin2023!", "count": 94 }, { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 58 }, { "user": "root", "pass": "3245gs5662d34", "count": 31 }, { "user": "admin", "pass": "admin", "count": 20 }, { "user": "root", "pass": "checking!@!@%", "count": 14 }, { "user": "debian", "pass": "temppwd", "count": 12 } ], "Medical imaging (DICOM)": [ { "user": "root", "pass": "checking!@!@%", "count": 3 }, { "user": "node", "pass": "node", "count": 3 }, { "user": "user", "pass": "passw0rd", "count": 2 }, { "user": "claude", "pass": "password", "count": 2 }, { "user": "root", "pass": "baidu@123", "count": 2 }, { "user": "guest", "pass": "abc123", "count": 2 } ], "SD-WAN controller": [ { "user": "", "pass": "", "count": 1 } ], "SSL-VPN appliance": [ { "user": "", "pass": "", "count": 1 } ], "Serial console server": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 10 }, { "user": "root", "pass": "checking!@!@%", "count": 4 }, { "user": "support", "pass": "123456", "count": 4 }, { "user": "root", "pass": "3245gs5662d34", "count": 3 }, { "user": "developer", "pass": "12345", "count": 2 }, { "user": "developer", "pass": "123", "count": 2 } ], "Siemens OT router": [ { "user": ";`cat /etc/passwd`", "pass": "\r\n", "count": 1 }, { "user": "admin", "pass": "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b", "count": 1 } ], "Water SCADA / PLC": [ { "user": "anonymous", "pass": "anonymous@", "count": 6 }, { "user": "anonymous", "pass": "IEUser@", "count": 4 }, { "user": "test", "pass": "test", "count": 2 }, { "user": "user", "pass": "123", "count": 1 }, { "user": "test", "pass": "123", "count": 1 }, { "user": "user", "pass": "12345", "count": 1 } ], "Windows AD / RDP": [ { "user": "hello", "pass": "", "count": 788 }, { "user": "anonymous", "pass": "", "count": 154 }, { "user": "Test", "pass": "", "count": 4 }, { "user": "administrator", "pass": "", "count": 1 }, { "user": "test", "pass": "", "count": 1 }, { "user": "omQVoOLLQ", "pass": "", "count": 1 } ] }, "mitre_observed": { "window": "24h", "enterprise": { "T1110": { "name": "Brute Force", "count": 3013 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 1881 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 1709 }, "T1021": { "name": "Remote Services", "count": 1377 }, "T1082": { "name": "System Information Discovery", "count": 89 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 12 }, "T1210": { "name": "Exploitation of Remote Services", "count": 3 }, "T1105": { "name": "Ingress Tool Transfer", "count": 1 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 1850 }, "T0861": { "name": "Point & Tag Identification", "count": 898 }, "T0801": { "name": "Monitoring Process State", "count": 898 }, "T0842": { "name": "Network Sniffing", "count": 806 }, "T0886": { "name": "Remote Services", "count": 413 }, "T0888": { "name": "System Firmware", "count": 233 }, "T0812": { "name": "Default Credentials", "count": 97 } } }, "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 37 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 23 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 21 }, { "id": "T1021", "name": "Remote Services", "pct": 17 }, { "id": "T1082", "name": "System Information Discovery", "pct": 1 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 }, { "id": "T1210", "name": "Exploitation of Remote Services", "pct": 0 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 0 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 41 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 9 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 8 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 5 }, { "name": "China", "lat": 35, "lon": 105, "pct": 4 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 3 }, { "name": "France", "lat": 46, "lon": 2, "pct": 3 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "Canada", "lat": 56, "lon": -106, "pct": 2 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 2 }, { "name": "Saudi Arabia", "lat": 24, "lon": 45, "pct": 2 } ], "feed": [ { "proto": "SSH", "origin": "HK", "act": "hands-on session, 12 commands", "arch": "Automated Session", "ac": "#FFB800" }, { "proto": "SSH", "origin": "HK", "act": "hands-on session, 6 commands", "arch": "Interactive Session", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "DE", "act": "hands-on session, 8 commands", "arch": "Interactive Session", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "US", "act": "hands-on session, 15 commands", "arch": "Automated Session", "ac": "#FFB800" }, { "proto": "SSH", "origin": "AD", "act": "busybox fingerprint -> wget dropper", "arch": "IoT Botnet Dropper", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 1 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 9 tries", "arch": "Credential Spray", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 7 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" } ], "nuisance_filtered": 4210, "captures": { "window_days": 11, "events": 10262711, "sessions": 533939, "unique_ips": 16824, "events_24h": 780375, "sessions_24h": 113353, "unique_ips_24h": 4842, "per_day": 932974, "per_week": 6530816, "per_month": 27989212, "alltime_estimate": 54949008, "alltime_floor": 54000000 }, "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.", "canary": { "updated_at": "2026-08-07T00:25:20Z", "tokens_planted": 4334, "bait_grab_ips": 240, "detonations_total": 35, "detonation_ips": 27, "incidents_total": 33, "incidents_cross_ip_reuse": 18, "recent_detonations": [ { "ts": "2026-08-05T19:21:28Z", "geo": "TR", "asn": "AS44620", "flavor": "http", "ua_class": "browser", "ip_redacted": "144.225.x.x" }, { "ts": "2026-08-05T18:30:15Z", "geo": "HK", "asn": "AS401434", "flavor": "http", "ua_class": "tool/scanner", "ip_redacted": "45.207.x.x" }, { "ts": "2026-08-04T07:06:13Z", "geo": "US", "asn": "AS23470", "flavor": "http", "ua_class": "tool/scanner", "ip_redacted": "199.127.x.x" }, { "ts": "2026-08-02T12:35:36Z", "geo": "TH", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.164.x.x" }, { "ts": "2026-08-02T08:36:47Z", "geo": "BR", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.157.x.x" }, { "ts": "2026-08-02T07:58:13Z", "geo": "DE", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.165.x.x" }, { "ts": "2026-08-02T07:29:00Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "170.106.x.x" }, { "ts": "2026-08-02T06:44:01Z", "geo": "US", "asn": "AS14618", "flavor": "http", "ua_class": "browser", "ip_redacted": "54.161.x.x" } ], "path_probes": { "total": 58, "distinct_ips": 7, "top_paths": [ { "path": "/_ignition/execute-solution", "n": 10 }, { "path": "/index.php/_ignition/execute-solution", "n": 10 }, { "path": "/public/_ignition/execute-solution", "n": 10 }, { "path": "/___proxy_subdomain_cpanel", "n": 3 }, { "path": "/.gitlab/merge_request_templates", "n": 2 }, { "path": "/elasticsearch_cluster_yml", "n": 2 }, { "path": "/rest/", "n": 2 }, { "path": "/rest/credentials-for-node", "n": 2 }, { "path": "/storage/logs/", "n": 2 }, { "path": "/.ssh/", "n": 2 }, { "path": "/", "n": 2 }, { "path": "/actuator/", "n": 2 } ], "families": [ { "name": "browser-UA (spoofed)", "n": 31 }, { "name": "Go-http-client", "n": 16 }, { "name": "TLM-Audit-Scanner", "n": 8 }, { "name": "l9scan / LeakIX", "n": 3 } ] }, "bait_kinds": [ { "kind": "dotenv", "deployed": 1989, "detonated": 24 }, { "kind": "aws_credentials", "deployed": 703, "detonated": 0 }, { "kind": "docker_compose", "deployed": 697, "detonated": 11 }, { "kind": "git_config", "deployed": 648, "detonated": 0 }, { "kind": "db_dsn", "deployed": 297, "detonated": 0 } ], "top_harvesters": [ { "ip_redacted": "38.60.x.x", "asn": "AS154177", "org": "LIGHT NODE LIMITED", "class": "cloud", "class_source": "verified", "cc": "HK", "grabs": 1816, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "156.239.x.x", "asn": "AS154321", "org": "CORENET CLOUD SDN. BHD.", "class": "hosting", "class_source": "verified", "cc": "MY", "grabs": 275, "context": "5 bait types \u00b7 mostly git_config" }, { "ip_redacted": "103.102.x.x", "asn": "AS203020", "org": "HostRoyale Technologies", "class": "hosting", "class_source": "verified", "cc": "IN", "grabs": 154, "context": "4 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "157.230.x.x", "asn": "AS14061", "org": "DigitalOcean, LLC", "class": "cloud", "class_source": "verified", "cc": "US", "grabs": 115, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "78.153.x.x", "asn": "AS202306", "org": "HOSTGLOBAL.PLUS LTD", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 97, "context": "1 bait type \u00b7 mostly dotenv" }, { "ip_redacted": "78.153.x.x", "asn": "AS202306", "org": "HOSTGLOBAL.PLUS LTD", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 75, "context": "1 bait type \u00b7 mostly dotenv" }, { "ip_redacted": "78.153.x.x", "asn": "AS202306", "org": "HOSTGLOBAL.PLUS LTD", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 70, "context": "1 bait type \u00b7 mostly dotenv" }, { "ip_redacted": "38.147.x.x", "asn": "AS967", "org": "VMISS Inc.", "class": "hosting", "class_source": "verified", "cc": "CA", "grabs": 69, "context": "1 bait type \u00b7 mostly dotenv" } ], "harvest_by_asn": [ { "asn": "AS154177", "org": "LIGHT NODE LIMITED", "class": "cloud", "class_source": "verified", "cc": "HK", "grabs": 1894, "ips": 11 }, { "asn": "AS202306", "org": "HOSTGLOBAL.PLUS LTD", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 341, "ips": 6 }, { "asn": "AS154321", "org": "CORENET CLOUD SDN. BHD.", "class": "hosting", "class_source": "verified", "cc": "MY", "grabs": 290, "ips": 2 }, { "asn": "AS203020", "org": "HostRoyale Technologies", "class": "hosting", "class_source": "verified", "cc": "IN", "grabs": 154, "ips": 1 }, { "asn": "AS14061", "org": "DigitalOcean, LLC", "class": "cloud", "class_source": "verified", "cc": "US", "grabs": 128, "ips": 8 }, { "asn": "AS212238", "org": "Datacamp / CDNEXT", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 95, "ips": 13 }, { "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN", "grabs": 72, "ips": 14 }, { "asn": "AS967", "org": "VMISS Inc.", "class": "hosting", "class_source": "verified", "cc": "CA", "grabs": 69, "ips": 1 } ], "harvest_mix": { "networks": 120, "ips": 240, "grabs": 4126, "by_class": [ { "class": "cloud", "n": 2198 }, { "class": "hosting", "n": 1230 }, { "class": "unclassified", "n": 658 }, { "class": "residential", "n": 31 }, { "class": "isp", "n": 5 }, { "class": "cdn", "n": 4 } ], "cloud_hosting_pct": 83.1, "note": "Both ends of this are commercial infrastructure. The bait is pulled from cloud and hosting networks, and the tokens are used from cloud and hosting networks -- these are two separate populations, not matched pairs. We cannot follow a token from a given harvester to a given detonation; the only traceable hops are the cross-IP reuse journeys, and all of those stay inside one provider." }, "reuse": { "total": 4, "journeys": [ { "picked_up": "43.133.x.x", "used_from": "43.164.x.x", "geo": "TH", "asn": "AS132203", "bait": "dotenv", "dwell_seconds": 750.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.133.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.164.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-08-02T12:35:36Z" }, { "picked_up": "43.131.x.x", "used_from": "43.157.x.x", "geo": "BR", "asn": "AS132203", "bait": "dotenv", "dwell_seconds": 713.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.131.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.157.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-08-02T08:36:47Z" }, { "picked_up": "43.133.x.x", "used_from": "43.165.x.x", "geo": "DE", "asn": "AS132203", "bait": "docker_compose", "dwell_seconds": 795.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.133.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.165.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-08-02T07:58:13Z" }, { "picked_up": "43.164.x.x", "used_from": "170.106.x.x", "geo": "US", "asn": "AS132203", "bait": "docker_compose", "dwell_seconds": 870.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.164.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "170.106.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-08-02T07:29:00Z" } ], "by_geo": [ { "geo": "US", "n": 16 }, { "geo": "SG", "n": 4 }, { "geo": "BR", "n": 3 }, { "geo": "DE", "n": 2 }, { "geo": "SE", "n": 2 }, { "geo": "HK", "n": 2 }, { "geo": "FR", "n": 2 }, { "geo": "ID", "n": 1 }, { "geo": "BT", "n": 1 }, { "geo": "JP", "n": 1 } ], "cdn_masked": 13, "by_asn": [ { "asn": "AS132203", "n": 17, "org": "Tencent Cloud", "class": "cloud", "class_source": "verified" }, { "asn": "AS23470", "n": 7, "org": "ReliableSite", "class": "hosting", "class_source": "verified" }, { "asn": "AS7922", "n": 3, "org": "Comcast", "class": "residential", "class_source": "verified" }, { "asn": "AS212238", "n": 2, "org": "Datacamp / CDNEXT", "class": "hosting", "class_source": "verified" }, { "asn": "AS41745", "n": 2, "org": "FORTIS-AS", "class": "hosting", "class_source": "verified" }, { "asn": "AS61112", "n": 1, "org": "AkileCloud", "class": "cloud", "class_source": "verified" }, { "asn": "AS14593", "n": 1, "org": "SpaceX Starlink", "class": "residential", "class_source": "verified" }, { "asn": "AS134972", "n": 1, "org": "IKUUU Network", "class": "hosting", "class_source": "verified" } ], "origin_mix": { "by_class": [ { "class": "cloud", "n": 18 }, { "class": "hosting", "n": 13 }, { "class": "residential", "n": 4 }, { "class": "isp", "n": 1 } ], "cloud_hosting_pct": 86.1, "mitre": [ { "id": "T1583.006", "name": "Acquire Infrastructure: Web Services" } ], "note": "86% of token uses arrive from cloud or hosting networks rather than end-user ISPs. We observe the origin network only, not how it was acquired \u2014 consistent with T1583.006, not proof of it." }, "asn_flow": [ { "from": { "ip_redacted": "43.133.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.164.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "n": 4 } ], "cdn_note": "13 further incidents are excluded: the bait was fetched through our own Cloudflare edge, so the true client IP was never recorded. They are a CDN artefact, not reuse.", "note": "4 of 4 reuse journeys share AS132203 \u2014 most likely one automated operator, not that many separate actors." } } }