{ "generated_at": "2026-07-20T12:28:51.454017Z", "window_hours": 24, "threat_index": { "value": 95, "label": "SEVERE", "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity" }, "kpis": { "events": "283K", "unique_ips": "7,761", "protocols_covered": 14, "continents_covered": 2, "top_technique": { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 100 } }, "hourly_volume": [ 5953, 4002, 3973, 5861, 4802, 4841, 4095, 3245, 2970, 3754, 6274, 3750, 3048, 3093, 4041, 4038, 3302, 6561, 4725, 4052, 6542, 3437, 4989, 6193 ], "windows": { "24h": { "events": "108K", "volume": [ 5953, 4002, 3973, 5861, 4802, 4841, 4095, 3245, 2970, 3754, 6274, 3750, 3048, 3093, 4041, 4038, 3302, 6561, 4725, 4052, 6542, 3437, 4989, 6193 ], "labels": [ "00:00", "01:00", "02:00", "03:00", "04:00", "05:00", "06:00", "07:00", "08:00", "09:00", "10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00", "17:00", "18:00", "19:00", "20:00", "21:00", "22:00", "23:00" ], "unit": "events / hour", "protocols": [ { "name": "SCADA-Modbus", "pct": 40, "amber": true }, { "name": "SSL-VPN", "pct": 20, "amber": false }, { "name": "HTTP", "pct": 17, "amber": false }, { "name": "DICOM", "pct": 11, "amber": false }, { "name": "Telnet", "pct": 9, "amber": false }, { "name": "WATER", "pct": 2, "amber": false }, { "name": "ATG-TLS", "pct": 1, "amber": true }, { "name": "Other", "pct": 1, "amber": false, "includes": [ "DNP3", "BACnet", "SSH", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "unique_ips": "1,652", "origins": [ { "name": "United States", "pct": 51 }, { "name": "Italy", "pct": 13 }, { "name": "France", "pct": 9 }, { "name": "United Kingdom", "pct": 9 }, { "name": "Canada", "pct": 6 }, { "name": "Germany", "pct": 3 }, { "name": "Ireland", "pct": 3 }, { "name": "Other", "pct": 6 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 51 }, { "name": "Italy", "lat": 42, "lon": 12, "pct": 13 }, { "name": "France", "lat": 46, "lon": 2, "pct": 9 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 9 }, { "name": "Canada", "lat": 56, "lon": -106, "pct": 6 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 3 }, { "name": "Ireland", "lat": 53, "lon": -8, "pct": 3 }, { "name": "Saudi Arabia", "lat": 24, "lon": 45, "pct": 1 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 1 }, { "name": "Sweden", "lat": 62, "lon": 15, "pct": 1 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 1 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 1 } ], "mitre": [ { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 100 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 0 }, { "id": "T1110", "name": "Brute Force", "pct": 0 }, { "id": "T1082", "name": "System Information Discovery", "pct": 0 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 0 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 } ], "mitre_observed": { "window": "24h", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 2111274 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 6696 }, "T1110": { "name": "Brute Force", "count": 3033 }, "T1082": { "name": "System Information Discovery", "count": 449 }, "T1105": { "name": "Ingress Tool Transfer", "count": 69 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 2 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 3163018 }, "T0842": { "name": "Network Sniffing", "count": 3148711 }, "T0888": { "name": "System Firmware", "count": 525492 }, "T0886": { "name": "Remote Services", "count": 525492 }, "T0861": { "name": "Point & Tag Identification", "count": 13460 }, "T0801": { "name": "Monitoring Process State", "count": 13460 }, "T0812": { "name": "Default Credentials", "count": 686 } } } }, "7d": { "events": "3.7M", "volume": [ 606588, 627856, 157174, 250945, 187521, 1467611, 442068 ], "labels": [ "07-14", "07-15", "07-16", "07-17", "07-18", "07-19", "07-20" ], "unit": "events / day", "protocols": [ { "name": "Telnet", "pct": 32, "amber": false }, { "name": "SCADA-Modbus", "pct": 29, "amber": true }, { "name": "SSH", "pct": 16, "amber": false }, { "name": "SSL-VPN", "pct": 11, "amber": false }, { "name": "HTTP", "pct": 8, "amber": false }, { "name": "DICOM", "pct": 5, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 53 }, { "name": "Germany", "pct": 9 }, { "name": "United States", "pct": 9 }, { "name": "Poland", "pct": 7 }, { "name": "China", "pct": 6 }, { "name": "United Kingdom", "pct": 4 }, { "name": "Bulgaria", "pct": 3 }, { "name": "Other", "pct": 9 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 53 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 9 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 9 }, { "name": "Poland", "lat": 52, "lon": 19, "pct": 7 }, { "name": "China", "lat": 35, "lon": 105, "pct": 6 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 4 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 3 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 2 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Colombia", "lat": 4, "lon": -72, "pct": 1 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 1 }, { "name": "Thailand", "lat": 15, "lon": 101, "pct": 1 } ], "unique_ips": "9,478", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 69 }, { "id": "T0812", "name": "Default Credentials", "pct": 10 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 9 }, { "id": "T1078", "name": "Valid Accounts", "pct": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 4 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 2 }, { "id": "T0801", "name": "Monitoring Process State", "pct": 1 }, { "id": "T0861", "name": "Point & Tag Identification", "pct": 1 } ], "mitre_observed": { "window": "win", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 21457 }, "T1110": { "name": "Brute Force", "count": 160666 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 8443 }, "T1078": { "name": "Valid Accounts", "count": 9448 }, "T1021": { "name": "Remote Services", "count": 308 }, "T1210": { "name": "Exploitation of Remote Services", "count": 50 }, "T1087": { "name": "Account Discovery", "count": 13 } }, "ics": { "T0801": { "name": "Monitoring Process State", "count": 2047 }, "T0846": { "name": "Remote System Discovery", "count": 4176 }, "T0861": { "name": "Point & Tag Identification", "count": 1548 }, "T0812": { "name": "Default Credentials", "count": 22755 }, "T0842": { "name": "Network Sniffing", "count": 1504 } } } }, "18d": { "events": "6.7M", "volume": [ 110635, 46783, 45005, 173523, 201059, 220838, 320951, 386989, 574934, 411829, 509335, 606588, 627856, 157174, 250945, 187521, 1467611, 442068 ], "labels": [ "07-03", "07-04", "07-05", "07-06", "07-07", "07-08", "07-09", "07-10", "07-11", "07-12", "07-13", "07-14", "07-15", "07-16", "07-17", "07-18", "07-19", "07-20" ], "unit": "events / day", "protocols": [ { "name": "Telnet", "pct": 30, "amber": false }, { "name": "SCADA-Modbus", "pct": 29, "amber": true }, { "name": "SSH", "pct": 21, "amber": false }, { "name": "SSL-VPN", "pct": 11, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "DICOM", "pct": 4, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 51 }, { "name": "United States", "pct": 10 }, { "name": "Germany", "pct": 8 }, { "name": "Poland", "pct": 7 }, { "name": "China", "pct": 5 }, { "name": "United Kingdom", "pct": 4 }, { "name": "Bulgaria", "pct": 3 }, { "name": "Other", "pct": 12 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 51 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 10 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 8 }, { "name": "Poland", "lat": 52, "lon": 19, "pct": 7 }, { "name": "China", "lat": 35, "lon": 105, "pct": 5 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 4 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 3 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 2 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "France", "lat": 46, "lon": 2, "pct": 2 }, { "name": "Colombia", "lat": 4, "lon": -72, "pct": 1 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 1 } ], "unique_ips": "11,616", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 68 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 10 }, { "id": "T0812", "name": "Default Credentials", "pct": 10 }, { "id": "T1078", "name": "Valid Accounts", "pct": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 4 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 2 }, { "id": "T0801", "name": "Monitoring Process State", "pct": 1 }, { "id": "T0861", "name": "Point & Tag Identification", "pct": 1 } ], "mitre_observed": { "window": "win", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 24632 }, "T1110": { "name": "Brute Force", "count": 160666 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 8443 }, "T1078": { "name": "Valid Accounts", "count": 9448 }, "T1021": { "name": "Remote Services", "count": 308 }, "T1210": { "name": "Exploitation of Remote Services", "count": 50 }, "T1087": { "name": "Account Discovery", "count": 13 } }, "ics": { "T0801": { "name": "Monitoring Process State", "count": 2555 }, "T0846": { "name": "Remote System Discovery", "count": 4684 }, "T0861": { "name": "Point & Tag Identification", "count": 2056 }, "T0812": { "name": "Default Credentials", "count": 22755 }, "T0842": { "name": "Network Sniffing", "count": 1504 } } } } }, "origins": [ { "name": "United States", "pct": 51 }, { "name": "Italy", "pct": 13 }, { "name": "France", "pct": 9 }, { "name": "United Kingdom", "pct": 9 }, { "name": "Canada", "pct": 6 }, { "name": "Germany", "pct": 3 }, { "name": "Ireland", "pct": 3 }, { "name": "Other", "pct": 6 } ], "protocols": [ { "name": "SCADA-Modbus", "pct": 40, "amber": true }, { "name": "SSL-VPN", "pct": 20, "amber": false }, { "name": "HTTP", "pct": 17, "amber": false }, { "name": "DICOM", "pct": 11, "amber": false }, { "name": "Telnet", "pct": 9, "amber": false }, { "name": "WATER", "pct": 2, "amber": false }, { "name": "ATG-TLS", "pct": 1, "amber": true }, { "name": "Other", "pct": 1, "amber": false, "includes": [ "DNP3", "BACnet", "SSH", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "credentials": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 258, "app": "Linux / SSH server" }, { "user": "admin", "pass": "admin", "count": 130, "app": "Linux / SSH server" }, { "user": "root", "pass": "root123", "count": 102, "app": "Telnet / IoT device" }, { "user": "root", "pass": "3245gs5662d34", "count": 98, "app": "Linux / SSH server" }, { "user": "root", "pass": "root", "count": 84, "app": "Telnet / IoT device" }, { "user": "admin", "pass": "admin123", "count": 74, "app": "Linux / SSH server" } ], "credentials_by_appliance": { "Auth / IdP appliance": [ { "user": "admin", "pass": "admin123", "count": 5 }, { "user": "root", "pass": "Forten1883", "count": 4 }, { "user": "root", "pass": "111111", "count": 4 }, { "user": "root", "pass": "India@2023", "count": 4 }, { "user": "root", "pass": "Vv123456", "count": 4 }, { "user": "npm", "pass": "npm", "count": 4 } ], "Building management (BMS)": [ { "user": "root", "pass": "Forten1883", "count": 4 }, { "user": "admin", "pass": "admin1234", "count": 2 }, { "user": "debian", "pass": "qwerty123456", "count": 2 }, { "user": "default", "pass": "121212", "count": 2 }, { "user": "root", "pass": "pi", "count": 2 }, { "user": "ubnt", "pass": "root", "count": 2 } ], "Linux / SSH server": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 188 }, { "user": "root", "pass": "3245gs5662d34", "count": 70 }, { "user": "admin", "pass": "admin", "count": 52 }, { "user": "root", "pass": "checking!@!@%", "count": 38 }, { "user": "admin", "pass": "admin123", "count": 34 }, { "user": "debian", "pass": "temppwd", "count": 29 } ], "Network switch": [ { "user": "admin", "pass": "admin", "count": 7 } ], "Serial console server": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 40 }, { "user": "root", "pass": "3245gs5662d34", "count": 16 }, { "user": "root", "pass": "Forten1883", "count": 4 }, { "user": "support", "pass": "123456", "count": 4 }, { "user": "labuser", "pass": "labuser", "count": 3 }, { "user": "oracle", "pass": "oracle1234!", "count": 3 } ], "Solar inverter": [ { "user": "admin", "pass": "admin123", "count": 2 }, { "user": "administrator", "pass": "administrator", "count": 2 }, { "user": "root", "pass": "linux", "count": 2 }, { "user": "default", "pass": "121212", "count": 2 }, { "user": "config", "pass": "P@ssw0rd", "count": 2 }, { "user": "unknown", "pass": "unknown1", "count": 2 } ], "Telnet / IoT device": [ { "user": "root", "pass": "root123", "count": 80 }, { "user": "root", "pass": "root", "count": 64 }, { "user": "user", "pass": "user", "count": 54 }, { "user": "support", "pass": "support", "count": 52 }, { "user": "root", "pass": "123456", "count": 46 }, { "user": "ftp", "pass": "ftp", "count": 42 } ], "UPS / power controller": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 30 }, { "user": "admin", "pass": "admin", "count": 12 }, { "user": "root", "pass": "3245gs5662d34", "count": 12 }, { "user": "root", "pass": "checking!@!@%", "count": 9 }, { "user": "root", "pass": "Forten1883", "count": 6 }, { "user": "admin", "pass": "123456", "count": 2 } ], "Water SCADA / PLC": [ { "user": "admin", "pass": "admin", "count": 16 }, { "user": "root", "pass": "checking!@!@%", "count": 4 }, { "user": "root", "pass": "root", "count": 2 }, { "user": "root", "pass": "root123", "count": 2 }, { "user": "runner", "pass": "1", "count": 2 }, { "user": "ubuntu", "pass": "123456", "count": 2 } ] }, "mitre_observed": { "window": "24h", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 2111274 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 6696 }, "T1110": { "name": "Brute Force", "count": 3033 }, "T1082": { "name": "System Information Discovery", "count": 449 }, "T1105": { "name": "Ingress Tool Transfer", "count": 69 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 2 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 3163018 }, "T0842": { "name": "Network Sniffing", "count": 3148711 }, "T0888": { "name": "System Firmware", "count": 525492 }, "T0886": { "name": "Remote Services", "count": 525492 }, "T0861": { "name": "Point & Tag Identification", "count": 13460 }, "T0801": { "name": "Monitoring Process State", "count": 13460 }, "T0812": { "name": "Default Credentials", "count": 686 } } }, "mitre": [ { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 100 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 0 }, { "id": "T1110", "name": "Brute Force", "pct": 0 }, { "id": "T1082", "name": "System Information Discovery", "pct": 0 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 0 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 51 }, { "name": "Italy", "lat": 42, "lon": 12, "pct": 13 }, { "name": "France", "lat": 46, "lon": 2, "pct": 9 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 9 }, { "name": "Canada", "lat": 56, "lon": -106, "pct": 6 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 3 }, { "name": "Ireland", "lat": 53, "lon": -8, "pct": 3 }, { "name": "Saudi Arabia", "lat": 24, "lon": 45, "pct": 1 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 1 }, { "name": "Sweden", "lat": 62, "lon": 15, "pct": 1 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 1 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 1 } ], "feed": [ { "proto": "SNMP", "origin": "FR", "act": "SNMP walk: sysDescr, ifTable, enterprise OIDs", "arch": "Human Attacker", "ac": "#00D4AA" }, { "proto": "SNMP", "origin": "SA", "act": "SNMP walk: sysDescr, ifTable, enterprise OIDs", "arch": "Agentic Attacker", "ac": "#FFB800" }, { "proto": "SSH", "origin": "US", "act": "hands-on session, 200 commands", "arch": "Agentic Attacker", "ac": "#FFB800" }, { "proto": "SSH", "origin": "DE", "act": "hands-on session, 8 commands", "arch": "Human Attacker", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 1 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 7 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "DE", "act": "Barracuda/SCALANCE login attempt, 17 tries", "arch": "Credential-Spray Bot", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 8 tries", "arch": "Credential-Spray Bot", "ac": "#00D4AA" } ], "nuisance_filtered": 6753, "captures": { "window_days": 10, "events": 2827356, "sessions": 362793, "unique_ips": 7761, "per_day": 282736, "per_week": 1979149, "per_month": 8482068, "alltime_estimate": 29393087, "alltime_floor": 29000000 }, "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.", "canary": { "updated_at": "2026-07-20T12:23:32Z", "tokens_planted": 2796, "bait_grab_ips": 82, "detonations_total": 60, "detonation_ips": 16, "incidents_total": 17, "incidents_cross_ip_reuse": 12, "recent_detonations": [ { "ts": "2026-07-19T06:15:37Z", "geo": "SE", "asn": "AS212238", "flavor": "http", "ua_class": "browser", "ip_redacted": "193.203.x.x" }, { "ts": "2026-07-18T15:32:44Z", "geo": "SE", "asn": "AS212238", "flavor": "http", "ua_class": "browser", "ip_redacted": "193.203.x.x" }, { "ts": "2026-07-18T10:07:20Z", "geo": "BR", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.157.x.x" }, { "ts": "2026-07-18T10:00:15Z", "geo": "DE", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "162.62.x.x" }, { "ts": "2026-07-18T09:50:05Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "170.106.x.x" }, { "ts": "2026-07-18T09:10:46Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.153.x.x" }, { "ts": "2026-07-18T08:52:33Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.166.x.x" }, { "ts": "2026-07-18T08:14:50Z", "geo": "SG", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.163.x.x" } ] } }