{
  "generated_at": "2026-07-14T06:30:46.768554Z",
  "window_hours": 24,
  "threat_index": {
    "value": 91,
    "label": "SEVERE",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "181K",
    "unique_ips": "12,550",
    "protocols_covered": 7,
    "continents_covered": 3,
    "top_technique": {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 64
    }
  },
  "hourly_volume": [
    13395,
    8607,
    11578,
    12285,
    11162,
    12183,
    15908,
    11043,
    10749,
    12300,
    20539,
    17891,
    9458,
    13672,
    9636,
    8771,
    15631,
    14539,
    10404,
    14286,
    10607,
    10333,
    13434,
    10459
  ],
  "origins": [
    {
      "name": "Netherlands",
      "pct": 30
    },
    {
      "name": "United States",
      "pct": 16
    },
    {
      "name": "United Kingdom",
      "pct": 9
    },
    {
      "name": "Germany",
      "pct": 7
    },
    {
      "name": "China",
      "pct": 5
    },
    {
      "name": "Other",
      "pct": 33
    }
  ],
  "protocols": [
    {
      "name": "Telnet",
      "pct": 36,
      "amber": false
    },
    {
      "name": "SSH",
      "pct": 26,
      "amber": false
    },
    {
      "name": "SCADA-Modbus",
      "pct": 20,
      "amber": true
    },
    {
      "name": "SSL-VPN",
      "pct": 12,
      "amber": false
    },
    {
      "name": "HTTP",
      "pct": 3,
      "amber": false
    },
    {
      "name": "DICOM",
      "pct": 2,
      "amber": false
    }
  ],
  "credentials": [
    {
      "user": "admin",
      "pass": "admin",
      "count": 116
    },
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34",
      "count": 96
    },
    {
      "user": "root",
      "pass": "root123",
      "count": 95
    },
    {
      "user": "chronos",
      "pass": "facepunch",
      "count": 91
    },
    {
      "user": "root",
      "pass": "root",
      "count": 71
    },
    {
      "user": "root",
      "pass": "12345",
      "count": 66
    }
  ],
  "mitre": [
    {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 64
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "pct": 23
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 7
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "pct": 5
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "pct": 1
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol (C2)",
      "pct": 0
    }
  ],
  "map_origins": [
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 30
    },
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 16
    },
    {
      "name": "United Kingdom",
      "lat": 54,
      "lon": -2,
      "pct": 9
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 7
    },
    {
      "name": "China",
      "lat": 35,
      "lon": 105,
      "pct": 5
    },
    {
      "name": "Pakistan",
      "lat": 30,
      "lon": 70,
      "pct": 4
    },
    {
      "name": "India",
      "lat": 21,
      "lon": 78,
      "pct": 3
    },
    {
      "name": "Vietnam",
      "lat": 16,
      "lon": 108,
      "pct": 3
    },
    {
      "name": "Ukraine",
      "lat": 49,
      "lon": 32,
      "pct": 2
    },
    {
      "name": "South Korea",
      "lat": 37,
      "lon": 128,
      "pct": 2
    },
    {
      "name": "France",
      "lat": 46,
      "lon": 2,
      "pct": 2
    },
    {
      "name": "Turkey",
      "lat": 39,
      "lon": 35,
      "pct": 1
    }
  ],
  "feed": [
    {
      "proto": "SSH",
      "origin": "IN",
      "act": "hands-on session, 7 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "NL",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Agentic Attacker",
      "ac": "#FFB800"
    },
    {
      "proto": "SSH",
      "origin": "NL",
      "act": "hands-on session, 10 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "MODBUS",
      "origin": "NL",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Agentic Attacker",
      "ac": "#FFB800"
    },
    {
      "proto": "SSH",
      "origin": "DE",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Mirai / IoT Botnet",
      "ac": "#00D4AA"
    },
    {
      "proto": "HTTP",
      "origin": "HK",
      "act": "Barracuda/SCALANCE login attempt, 2 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "Barracuda/SCALANCE login attempt, 1 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "US",
      "act": "hardware probe -> miner deploy attempt",
      "arch": "Cryptominer Operator",
      "ac": "#00D4AA"
    }
  ],
  "nuisance_filtered": 4193,
  "captures": {
    "window_days": 18,
    "events": 3255635,
    "sessions": 856468,
    "unique_ips": 12550,
    "per_day": 180869,
    "per_week": 1266080,
    "per_month": 5426058,
    "alltime_estimate": 25655635,
    "alltime_floor": 25000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.",
  "canary": {
    "updated_at": "2026-07-14T06:30:44Z",
    "tokens_planted": 145,
    "bait_grab_ips": 16,
    "detonations_total": 11,
    "detonation_ips": 4,
    "incidents_total": 8,
    "incidents_cross_ip_reuse": 3,
    "recent_detonations": [
      {
        "ts": "2026-07-11T17:27:23Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.159.x.x"
      },
      {
        "ts": "2026-07-11T17:13:31Z",
        "geo": "BR",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.157.x.x"
      },
      {
        "ts": "2026-07-11T14:23:55Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "170.106.x.x"
      },
      {
        "ts": "2026-07-11T02:26:36Z",
        "geo": "NL",
        "asn": "AS48090",
        "flavor": "http",
        "ua_class": "tool/scanner",
        "ip_redacted": "195.178.x.x"
      }
    ]
  }
}