{ "generated_at": "2026-10-22T00:22:29.108551Z", "window_hours": 24, "threat_index": { "value": 56, "label": "GUARDED", "ratio_to_normal": 0.53, "baseline_events_per_day": 895708, "basis": "last 24h volume against the median of the previous 14 complete days, plus observed high-severity techniques and hands-on activity" }, "kpis": { "events": "272K", "unique_ips": "6,438", "protocols_covered": 22, "continents_covered": 6, "top_technique": { "id": "T1110", "name": "Brute Force", "pct": 44 } }, "hourly_volume": [ 13376, 11091, 13714, 14205, 16370, 12416, 10154, 9675, 7396, 8685, 12231, 7548, 5839, 9498, 9652, 9286, 7139, 13639, 3523, 8482, 17091, 23058, 9860, 9389 ], "windows": { "24h": { "events": "472K", "volume": [ 13376, 11091, 13714, 14205, 16370, 12416, 10154, 9675, 7396, 8685, 12231, 7548, 5839, 9498, 9652, 9286, 7139, 13639, 3523, 8482, 17091, 23058, 9860, 9389 ], "labels": [ "00:00", "01:00", "02:00", "03:00", "04:00", "05:00", "06:00", "07:00", "08:00", "09:00", "10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00", "17:00", "18:00", "19:00", "20:00", "21:00", "22:00", "23:00" ], "unit": "events / hour", "protocols": [ { "name": "RDP", "pct": 34, "amber": false }, { "name": "SSH", "pct": 20, "amber": false }, { "name": "SSL-VPN", "pct": 14, "amber": false }, { "name": "SCADA-Modbus", "pct": 14, "amber": true }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "Telnet", "pct": 5, "amber": false }, { "name": "DICOM", "pct": 4, "amber": false }, { "name": "Other", "pct": 3, "amber": false, "includes": [ "WATER", "DNP3", "ATG-TLS", "GE-SRTP", "BACnet", "EtherNet/IP", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "unique_ips": "2,383", "origins": [ { "name": "United States", "pct": 40 }, { "name": "Germany", "pct": 8 }, { "name": "United Kingdom", "pct": 8 }, { "name": "Netherlands", "pct": 7 }, { "name": "China", "pct": 4 }, { "name": "France", "pct": 3 }, { "name": "South Korea", "pct": 3 }, { "name": "Other", "pct": 27 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 40 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 8 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 8 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 7 }, { "name": "China", "lat": 35, "lon": 105, "pct": 4 }, { "name": "France", "lat": 46, "lon": 2, "pct": 3 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 3 }, { "name": "Belgium", "lat": 51, "lon": 4, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 2 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 2 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "Russia", "lat": 56, "lon": 44, "pct": 2 } ], "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 44 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 25 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 16 }, { "id": "T1021", "name": "Remote Services", "pct": 10 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 3 }, { "id": "T1082", "name": "System Information Discovery", "pct": 2 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 }, { "id": "T1003", "name": "OS Credential Dumping", "pct": 0 }, { "id": "T1087", "name": "Account Discovery", "pct": 0 }, { "id": "T1070", "name": "Indicator Removal", "pct": 0 }, { "id": "T1210", "name": "Exploitation of Remote Services", "pct": 0 } ], "mitre_observed": { "window": "24h", "enterprise": { "T1110": { "name": "Brute Force", "count": 6033 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 3509 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 2210 }, "T1021": { "name": "Remote Services", "count": 1378 }, "T1105": { "name": "Ingress Tool Transfer", "count": 358 }, "T1082": { "name": "System Information Discovery", "count": 312 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 40 }, "T1003": { "name": "OS Credential Dumping", "count": 8 }, "T1087": { "name": "Account Discovery", "count": 5 }, "T1070": { "name": "Indicator Removal", "count": 4 }, "T1210": { "name": "Exploitation of Remote Services", "count": 3 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 1440 }, "T0861": { "name": "Point & Tag Identification", "count": 920 }, "T0801": { "name": "Monitoring Process State", "count": 920 }, "T0842": { "name": "Network Sniffing", "count": 407 }, "T0886": { "name": "Remote Services", "count": 393 }, "T0888": { "name": "System Firmware", "count": 207 }, "T0812": { "name": "Default Credentials", "count": 94 } } } }, "7d": { "events": "3.8M", "volume": [ 1556953, 539513, 448719, 378163, 409935, 473560, 4204 ], "labels": [ "10-16", "10-17", "10-18", "10-19", "10-20", "10-21", "10-22" ], "unit": "events / day", "protocols": [ { "name": "WATER", "pct": 26, "amber": false }, { "name": "RDP", "pct": 21, "amber": false }, { "name": "SSH", "pct": 16, "amber": false }, { "name": "SCADA-Modbus", "pct": 13, "amber": true }, { "name": "SSL-VPN", "pct": 10, "amber": false }, { "name": "Telnet", "pct": 5, "amber": false } ], "origins": [ { "name": "United States", "pct": 40 }, { "name": "Netherlands", "pct": 16 }, { "name": "Ukraine", "pct": 10 }, { "name": "Hong Kong", "pct": 8 }, { "name": "Russia", "pct": 4 }, { "name": "China", "pct": 4 }, { "name": "Germany", "pct": 4 }, { "name": "Other", "pct": 14 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 40 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 16 }, { "name": "Ukraine", "lat": 49, "lon": 32, "pct": 10 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 8 }, { "name": "Russia", "lat": 56, "lon": 44, "pct": 4 }, { "name": "China", "lat": 35, "lon": 105, "pct": 4 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 4 }, { "name": "France", "lat": 46, "lon": 2, "pct": 4 }, { "name": "Japan", "lat": 36, "lon": 138, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 2 }, { "name": "Egypt", "lat": 26, "lon": 30, "pct": 2 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 } ], "unique_ips": "16,471", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 67 }, { "id": "T1021", "name": "Remote Services", "pct": 19 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 3 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 2 }, { "id": "T0801", "name": "Monitoring Process State", "pct": 1 }, { "id": "T0861", "name": "Point & Tag Identification", "pct": 1 }, { "id": "T1078", "name": "Valid Accounts", "pct": 1 } ], "mitre_observed": { "window": "win", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 28304 }, "T1110": { "name": "Brute Force", "count": 419506 }, "T1078": { "name": "Valid Accounts", "count": 6053 }, "T1021": { "name": "Remote Services", "count": 121863 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 20953 }, "T1087": { "name": "Account Discovery", "count": 334 }, "T1210": { "name": "Exploitation of Remote Services", "count": 635 }, "T1187": { "name": "Forced Authentication", "count": 2 } }, "ics": { "T0801": { "name": "Monitoring Process State", "count": 8452 }, "T0861": { "name": "Point & Tag Identification", "count": 8239 }, "T0846": { "name": "Remote System Discovery", "count": 13582 }, "T0842": { "name": "Network Sniffing", "count": 2309 }, "T0812": { "name": "Default Credentials", "count": 40 } } } }, "18d": { "events": "14.6M", "volume": [ 667291, 461119, 772316, 890054, 1050407, 1182069, 901362, 1141695, 1779349, 834897, 1151780, 1556953, 539513, 448719, 378163, 409935, 473560, 4204 ], "labels": [ "10-05", "10-06", "10-07", "10-08", "10-09", "10-10", "10-11", "10-12", "10-13", "10-14", "10-15", "10-16", "10-17", "10-18", "10-19", "10-20", "10-21", "10-22" ], "unit": "events / day", "protocols": [ { "name": "WATER", "pct": 42, "amber": false }, { "name": "RDP", "pct": 15, "amber": false }, { "name": "SSH", "pct": 12, "amber": false }, { "name": "SCADA-Modbus", "pct": 10, "amber": true }, { "name": "SSL-VPN", "pct": 8, "amber": false }, { "name": "Telnet", "pct": 5, "amber": false } ], "origins": [ { "name": "United States", "pct": 47 }, { "name": "Netherlands", "pct": 9 }, { "name": "China", "pct": 7 }, { "name": "Hong Kong", "pct": 6 }, { "name": "Germany", "pct": 4 }, { "name": "Taiwan", "pct": 4 }, { "name": "France", "pct": 4 }, { "name": "Other", "pct": 19 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 47 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 9 }, { "name": "China", "lat": 35, "lon": 105, "pct": 7 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 6 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 4 }, { "name": "Taiwan", "lat": 24, "lon": 121, "pct": 4 }, { "name": "France", "lat": 46, "lon": 2, "pct": 4 }, { "name": "Russia", "lat": 56, "lon": 44, "pct": 3 }, { "name": "Ukraine", "lat": 49, "lon": 32, "pct": 3 }, { "name": "Australia", "lat": -25, "lon": 133, "pct": 2 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Iran", "lat": 32, "lon": 53, "pct": 2 } ], "unique_ips": "35,690", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 75 }, { "id": "T1021", "name": "Remote Services", "pct": 14 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 4 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 3 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 2 }, { "id": "T0801", "name": "Monitoring Process State", "pct": 1 }, { "id": "T0861", "name": "Point & Tag Identification", "pct": 1 }, { "id": "T1078", "name": "Valid Accounts", "pct": 1 } ], "mitre_observed": { "window": "win", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 78973 }, "T1021": { "name": "Remote Services", "count": 328421 }, "T1110": { "name": "Brute Force", "count": 1817873 }, "T1087": { "name": "Account Discovery", "count": 998 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 92587 }, "T1078": { "name": "Valid Accounts", "count": 20236 }, "T1210": { "name": "Exploitation of Remote Services", "count": 2045 }, "T1187": { "name": "Forced Authentication", "count": 882 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 37516 }, "T0842": { "name": "Network Sniffing", "count": 6423 }, "T0801": { "name": "Monitoring Process State", "count": 21848 }, "T0861": { "name": "Point & Tag Identification", "count": 21101 }, "T0812": { "name": "Default Credentials", "count": 701 } } } } }, "origins": [ { "name": "United States", "pct": 40 }, { "name": "Germany", "pct": 8 }, { "name": "United Kingdom", "pct": 8 }, { "name": "Netherlands", "pct": 7 }, { "name": "China", "pct": 4 }, { "name": "France", "pct": 3 }, { "name": "South Korea", "pct": 3 }, { "name": "Other", "pct": 27 } ], "protocols": [ { "name": "RDP", "pct": 34, "amber": false }, { "name": "SSH", "pct": 20, "amber": false }, { "name": "SSL-VPN", "pct": 14, "amber": false }, { "name": "SCADA-Modbus", "pct": 14, "amber": true }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "Telnet", "pct": 5, "amber": false }, { "name": "DICOM", "pct": 4, "amber": false }, { "name": "Other", "pct": 3, "amber": false, "includes": [ "WATER", "DNP3", "ATG-TLS", "GE-SRTP", "BACnet", "EtherNet/IP", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "credentials": [ { "user": "admin", "pass": "admin", "count": 375, "app": "Telnet / IoT device" }, { "user": "admin", "pass": "admin123", "count": 259, "app": "Linux / SSH server" }, { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 118, "app": "Linux / SSH server" }, { "user": "root", "pass": "root", "count": 64, "app": "Telnet / IoT device" }, { "user": "root", "pass": "xc3511", "count": 52, "app": "Telnet / IoT device" }, { "user": "root", "pass": "admin", "count": 50, "app": "Telnet / IoT device" } ], "credentials_by_appliance": { "Auth / IdP appliance": [ { "user": "admin", "pass": "admin123", "count": 8 }, { "user": "hermes", "pass": "hermes", "count": 7 }, { "user": "admin", "pass": "password", "count": 3 }, { "user": "admin", "pass": "qwerty", "count": 3 }, { "user": "test", "pass": "operator", "count": 3 }, { "user": "ont", "pass": "123456", "count": 3 } ], "Building management (BMS)": [ { "user": "root", "pass": "1234abcd@", "count": 6 }, { "user": "nw", "pass": "nw", "count": 6 }, { "user": "red", "pass": "red", "count": 6 }, { "user": "ddd", "pass": "1234", "count": 6 }, { "user": "root", "pass": "qwe@123", "count": 6 }, { "user": "root", "pass": "3edc$RFV5tgb^YHN", "count": 6 } ], "Linux / SSH server": [ { "user": "admin", "pass": "admin123", "count": 242 }, { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 72 }, { "user": "admin", "pass": "admin", "count": 35 }, { "user": "user", "pass": "admin2023!", "count": 31 }, { "user": "root", "pass": "3245gs5662d34", "count": 23 }, { "user": "admin", "pass": "12345", "count": 12 } ], "Medical imaging (DICOM)": [ { "user": "root", "pass": "777777", "count": 4 }, { "user": "test036", "pass": "123456", "count": 3 }, { "user": "shanta", "pass": "shanta", "count": 2 }, { "user": "john", "pass": "test", "count": 2 }, { "user": "debian", "pass": "Admin@123", "count": 2 }, { "user": "vlad", "pass": "1234", "count": 2 } ], "Serial console server": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 46 }, { "user": "support", "pass": "123456", "count": 10 }, { "user": "root", "pass": "3245gs5662d34", "count": 9 }, { "user": "admin", "pass": "3245gs5662d34", "count": 4 }, { "user": "admin", "pass": "admin", "count": 3 }, { "user": "temp", "pass": "admin123", "count": 3 } ], "Siemens OT router": [ { "user": "admin", "pass": "admin", "count": 5 }, { "user": "admin", "pass": "password", "count": 4 }, { "user": "root", "pass": "root", "count": 4 }, { "user": "admin", "pass": "12345", "count": 4 }, { "user": "admin", "pass": "123456", "count": 4 }, { "user": "admin", "pass": "12345678", "count": 4 } ], "Telnet / IoT device": [ { "user": "admin", "pass": "admin", "count": 327 }, { "user": "root", "pass": "", "count": 104 }, { "user": "root", "pass": "root", "count": 60 }, { "user": "root", "pass": "xc3511", "count": 52 }, { "user": "root", "pass": "admin", "count": 43 }, { "user": "root", "pass": "123456", "count": 41 } ], "Water SCADA / PLC": [ { "user": "", "pass": "", "count": 47 }, { "user": "PlcmSpIp", "pass": "PlcmSpIp", "count": 2 }, { "user": "anonymous", "pass": "anonymous@", "count": 2 }, { "user": "anonymous", "pass": "", "count": 2 }, { "user": "anonymous", "pass": "IEUser@", "count": 2 }, { "user": "anonymous", "pass": "anon@probe.local", "count": 2 } ], "Windows AD / RDP": [ { "user": "hello", "pass": "", "count": 284 }, { "user": "38.54.64.176", "pass": "", "count": 4 }, { "user": "38.54.64.182", "pass": "", "count": 3 }, { "user": "VQgtordTz", "pass": "", "count": 1 }, { "user": "KTXwWv", "pass": "", "count": 1 }, { "user": "bjkEfEoCe", "pass": "", "count": 1 } ] }, "mitre_observed": { "window": "24h", "enterprise": { "T1110": { "name": "Brute Force", "count": 6033 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 3509 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 2210 }, "T1021": { "name": "Remote Services", "count": 1378 }, "T1105": { "name": "Ingress Tool Transfer", "count": 358 }, "T1082": { "name": "System Information Discovery", "count": 312 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 40 }, "T1003": { "name": "OS Credential Dumping", "count": 8 }, "T1087": { "name": "Account Discovery", "count": 5 }, "T1070": { "name": "Indicator Removal", "count": 4 }, "T1210": { "name": "Exploitation of Remote Services", "count": 3 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 1440 }, "T0861": { "name": "Point & Tag Identification", "count": 920 }, "T0801": { "name": "Monitoring Process State", "count": 920 }, "T0842": { "name": "Network Sniffing", "count": 407 }, "T0886": { "name": "Remote Services", "count": 393 }, "T0888": { "name": "System Firmware", "count": 207 }, "T0812": { "name": "Default Credentials", "count": 94 } } }, "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 44 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 25 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 16 }, { "id": "T1021", "name": "Remote Services", "pct": 10 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 3 }, { "id": "T1082", "name": "System Information Discovery", "pct": 2 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 }, { "id": "T1003", "name": "OS Credential Dumping", "pct": 0 }, { "id": "T1087", "name": "Account Discovery", "pct": 0 }, { "id": "T1070", "name": "Indicator Removal", "pct": 0 }, { "id": "T1210", "name": "Exploitation of Remote Services", "pct": 0 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 40 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 8 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 8 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 7 }, { "name": "China", "lat": 35, "lon": 105, "pct": 4 }, { "name": "France", "lat": 46, "lon": 2, "pct": 3 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 3 }, { "name": "Belgium", "lat": 51, "lon": 4, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 2 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 2 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "Russia", "lat": 56, "lon": 44, "pct": 2 } ], "feed": [ { "proto": "SSH", "origin": "KR", "act": "hands-on session, 9 commands", "arch": "Interactive Session", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "MX", "act": "hands-on session, 6 commands", "arch": "Interactive Session", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "US", "act": "hands-on session, 15 commands", "arch": "Automated Session", "ac": "#FFB800" }, { "proto": "SSH", "origin": "US", "act": "hands-on session, 12 commands", "arch": "Automated Session", "ac": "#FFB800" }, { "proto": "SSH", "origin": "IR", "act": "busybox fingerprint -> wget dropper", "arch": "IoT Botnet Dropper", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "DE", "act": "Barracuda/SCALANCE login attempt, 112 tries", "arch": "Credential Spray", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "NL", "act": "Barracuda/SCALANCE login attempt, 1 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" }, { "proto": "SNMP", "origin": "NL", "act": "Barracuda/SCALANCE login attempt, 3 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" } ], "nuisance_filtered": 5950, "captures": { "window_days": 3, "events": 817134, "sessions": 225404, "unique_ips": 6438, "events_24h": 472054, "sessions_24h": 128901, "unique_ips_24h": 3833, "per_day": 272378, "per_week": 1906646, "per_month": 8171340, "alltime_estimate": 128282016, "alltime_floor": 128000000 }, "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.", "canary": { "updated_at": "2026-10-22T00:22:22Z", "tokens_planted": 17564, "bait_grab_ips": 1635, "detonations_total": 158, "detonation_ips": 122, "incidents_total": 144, "incidents_cross_ip_reuse": 117, "recent_detonations": [ { "ts": "2026-10-18T23:09:35Z", "geo": "KR", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.155.x.x" }, { "ts": "2026-10-17T22:04:00Z", "geo": "DE", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.165.x.x" }, { "ts": "2026-10-17T21:34:28Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "170.106.x.x" }, { "ts": "2026-10-17T21:03:01Z", "geo": "JP", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.167.x.x" }, { "ts": "2026-10-17T20:32:39Z", "geo": "SG", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.134.x.x" }, { "ts": "2026-10-17T18:42:23Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.130.x.x" }, { "ts": "2026-10-17T18:10:32Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.130.x.x" }, { "ts": "2026-10-17T16:30:14Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.130.x.x" } ], "path_probes": { "total": 155, "distinct_ips": 26, "top_paths": [ { "path": "/_ignition/execute-solution", "n": 12 }, { "path": "/index.php/_ignition/execute-solution", "n": 10 }, { "path": "/public/_ignition/execute-solution", "n": 10 }, { "path": "/selectTempConfig", "n": 6 }, { "path": "/api/getWebSiteConfig", "n": 6 }, { "path": "/api/dict/getServiceConfig", "n": 6 }, { "path": "/api/system/customer-service", "n": 6 }, { "path": "/api/v6/Comm/getVersionInfoV4", "n": 6 }, { "path": "/masterControl/getSystemSetting", "n": 6 }, { "path": "/api/currency/getTradeCurrencyList", "n": 6 }, { "path": "/api/seller/index/GetSellerConfigAll", "n": 6 }, { "path": "/api/system/systemConfigs/", "n": 6 } ], "families": [ { "name": "browser-UA (spoofed)", "n": 113 }, { "name": "Go-http-client", "n": 24 }, { "name": "TLM-Audit-Scanner", "n": 8 }, { "name": "other", "n": 4 }, { "name": "l9scan / LeakIX", "n": 3 }, { "name": "curl", "n": 3 } ] }, "bait_kinds": [ { "kind": "dotenv", "deployed": 8486, "detonated": 94 }, { "kind": "docker_compose", "deployed": 2728, "detonated": 64 }, { "kind": "db_dsn", "deployed": 2250, "detonated": 0 }, { "kind": "git_config", "deployed": 2120, "detonated": 0 }, { "kind": "aws_credentials", "deployed": 1980, "detonated": 0 } ], "top_harvesters": [ { "ip_redacted": "38.60.x.x", "asn": "AS154177", "org": "LIGHT NODE LIMITED", "class": "cloud", "class_source": "verified", "cc": "HK", "grabs": 1816, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "144.24.x.x", "asn": "AS31898", "org": "Oracle Corporation", "class": "unclassified", "class_source": "heuristic", "cc": "US", "grabs": 707, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "194.180.x.x", "asn": "AS201814", "org": "MEVSPACE sp. z o.o.", "class": "unclassified", "class_source": "heuristic", "cc": "PL", "grabs": 497, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "185.213.x.x", "asn": "AS21859", "org": "Zenlayer Inc", "class": "unclassified", "class_source": "heuristic", "cc": "US", "grabs": 405, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "213.163.x.x", "asn": "AS202053", "org": "UpCloud Ltd", "class": "unclassified", "class_source": "heuristic", "cc": "FI", "grabs": 405, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "193.23.x.x", "asn": "AS215439", "org": "PLAY2GO INTERNATIONAL LIMITED", "class": "unclassified", "class_source": "heuristic", "cc": "GB", "grabs": 382, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "149.40.x.x", "asn": "AS212238", "org": "Datacamp / CDNEXT", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 362, "context": "5 bait types \u00b7 mostly dotenv" }, { "ip_redacted": "78.153.x.x", "asn": "AS202306", "org": "HOSTGLOBAL.PLUS LTD", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 335, "context": "1 bait type \u00b7 mostly dotenv" } ], "harvest_by_asn": [ { "asn": "AS154177", "org": "LIGHT NODE LIMITED", "class": "cloud", "class_source": "verified", "cc": "HK", "grabs": 2016, "ips": 25 }, { "asn": "AS202306", "org": "HOSTGLOBAL.PLUS LTD", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 1440, "ips": 6 }, { "asn": "AS212238", "org": "Datacamp / CDNEXT", "class": "hosting", "class_source": "verified", "cc": "GB", "grabs": 1058, "ips": 65 }, { "asn": "AS31898", "org": "Oracle Corporation", "class": "unclassified", "class_source": "heuristic", "cc": "US", "grabs": 872, "ips": 27 }, { "asn": "AS201814", "org": "MEVSPACE sp. z o.o.", "class": "unclassified", "class_source": "heuristic", "cc": "PL", "grabs": 521, "ips": 4 }, { "asn": "AS14061", "org": "DigitalOcean, LLC", "class": "cloud", "class_source": "verified", "cc": "US", "grabs": 459, "ips": 87 }, { "asn": "AS21859", "org": "Zenlayer Inc", "class": "unclassified", "class_source": "heuristic", "cc": "US", "grabs": 455, "ips": 5 }, { "asn": "AS48090", "org": "TECHOFF SRV LIMITED", "class": "unclassified", "class_source": "heuristic", "cc": "GB", "grabs": 439, "ips": 18 } ], "harvest_mix": { "networks": 419, "ips": 1635, "grabs": 16972, "by_class": [ { "class": "unclassified", "n": 8290 }, { "class": "hosting", "n": 4192 }, { "class": "cloud", "n": 3898 }, { "class": "residential", "n": 520 }, { "class": "cdn", "n": 67 }, { "class": "isp", "n": 5 } ], "cloud_hosting_pct": 47.7, "note": "Both ends of this are commercial infrastructure. The bait is pulled from cloud and hosting networks, and the tokens are used from cloud and hosting networks -- these are two separate populations, not matched pairs. We cannot follow a token from a given harvester to a given detonation; the only traceable hops are the cross-IP reuse journeys, and all of those stay inside one provider." }, "reuse": { "total": 86, "journeys": [ { "picked_up": "43.159.x.x", "used_from": "43.165.x.x", "geo": "DE", "asn": "AS132203", "bait": "docker_compose", "dwell_seconds": 937.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.159.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.165.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-17T22:04:00Z" }, { "picked_up": "43.166.x.x", "used_from": "170.106.x.x", "geo": "US", "asn": "AS132203", "bait": "dotenv", "dwell_seconds": 243.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.166.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "170.106.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-17T21:34:28Z" }, { "picked_up": "43.130.x.x", "used_from": "43.167.x.x", "geo": "JP", "asn": "AS132203", "bait": "docker_compose", "dwell_seconds": 1357.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.130.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.167.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-17T21:03:01Z" }, { "picked_up": "43.165.x.x", "used_from": "43.134.x.x", "geo": "SG", "asn": "AS132203", "bait": "dotenv", "dwell_seconds": 188.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.165.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.134.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-17T20:32:39Z" }, { "picked_up": "43.128.x.x", "used_from": "43.130.x.x", "geo": "US", "asn": "AS132203", "bait": "dotenv", "dwell_seconds": 1464.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.128.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.130.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-17T18:42:23Z" }, { "picked_up": "43.165.x.x", "used_from": "43.130.x.x", "geo": "US", "asn": "AS132203", "bait": "dotenv", "dwell_seconds": 197.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.165.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.130.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-17T18:10:32Z" }, { "picked_up": "43.167.x.x", "used_from": "43.130.x.x", "geo": "US", "asn": "AS132203", "bait": "docker_compose", "dwell_seconds": 234.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.167.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.130.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-17T16:30:14Z" }, { "picked_up": "43.157.x.x", "used_from": "170.106.x.x", "geo": "US", "asn": "AS132203", "bait": "docker_compose", "dwell_seconds": 811.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.157.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "170.106.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-10T22:54:06Z" }, { "picked_up": "43.166.x.x", "used_from": "43.130.x.x", "geo": "US", "asn": "AS132203", "bait": "dotenv", "dwell_seconds": 244.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.166.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.130.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-10T22:23:46Z" }, { "picked_up": "43.159.x.x", "used_from": "101.33.x.x", "geo": "KR", "asn": "AS132203", "bait": "docker_compose", "dwell_seconds": 351.0, "ua_class": "browser", "asn_org": "Tencent Cloud", "asn_class": "cloud", "from": { "ip_redacted": "43.159.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "101.33.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "ts": "2026-10-10T21:15:27Z" } ], "by_geo": [ { "geo": "US", "n": 64 }, { "geo": "SG", "n": 20 }, { "geo": "BR", "n": 12 }, { "geo": "DE", "n": 9 }, { "geo": "KR", "n": 9 }, { "geo": "JP", "n": 8 }, { "geo": "SE", "n": 7 }, { "geo": "HK", "n": 6 }, { "geo": "IT", "n": 5 }, { "geo": "ID", "n": 2 } ], "cdn_masked": 29, "by_asn": [ { "asn": "AS132203", "n": 107, "org": "Tencent Cloud", "class": "cloud", "class_source": "verified" }, { "asn": "AS212238", "n": 10, "org": "Datacamp / CDNEXT", "class": "hosting", "class_source": "verified" }, { "asn": "AS7922", "n": 8, "org": "Comcast", "class": "residential", "class_source": "verified" }, { "asn": "AS23470", "n": 7, "org": "ReliableSite", "class": "hosting", "class_source": "verified" }, { "asn": "AS30722", "n": 3, "org": "unresolved", "class": "unclassified", "class_source": "none" }, { "asn": "AS41745", "n": 2, "org": "FORTIS-AS", "class": "hosting", "class_source": "verified" }, { "asn": "AS9009", "n": 2, "org": "unresolved", "class": "unclassified", "class_source": "none" }, { "asn": "AS202053", "n": 2, "org": "unresolved", "class": "unclassified", "class_source": "none" } ], "origin_mix": { "by_class": [ { "class": "cloud", "n": 108 }, { "class": "hosting", "n": 21 }, { "class": "unclassified", "n": 19 }, { "class": "residential", "n": 9 }, { "class": "isp", "n": 1 } ], "cloud_hosting_pct": 81.6, "mitre": [ { "id": "T1583.006", "name": "Acquire Infrastructure: Web Services" } ], "note": "82% of token uses arrive from cloud or hosting networks rather than end-user ISPs. We observe the origin network only, not how it was acquired \u2014 consistent with T1583.006, not proof of it." }, "asn_flow": [ { "from": { "ip_redacted": "43.159.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "to": { "ip_redacted": "43.165.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "n": 77 }, { "from": { "ip_redacted": "213.163.x.x", "asn": "AS202053", "org": "UpCloud Ltd", "class": "unclassified", "class_source": "heuristic", "cc": "FI" }, "to": { "ip_redacted": "redacted", "asn": "AS202053", "org": "UpCloud Ltd", "class": "unclassified", "class_source": "heuristic", "cc": "FI" }, "n": 1 }, { "from": { "ip_redacted": "213.144.x.x", "asn": "AS13030", "org": "Init7 (Switzerland) Ltd.", "class": "unclassified", "class_source": "heuristic", "cc": "CH" }, "to": { "ip_redacted": "169.150.x.x", "asn": "AS212238", "org": "Datacamp / CDNEXT", "class": "hosting", "class_source": "verified", "cc": "GB" }, "n": 1 }, { "from": { "ip_redacted": "185.255.x.x", "asn": "AS214716", "org": "WEYRO LTD", "class": "unclassified", "class_source": "heuristic", "cc": "GB" }, "to": { "ip_redacted": "50.7.x.x", "asn": "AS30058", "org": "FDCservers.net", "class": "unclassified", "class_source": "heuristic", "cc": "US" }, "n": 1 }, { "from": { "ip_redacted": "96.44.x.x", "asn": "AS36352", "org": "HostPapa", "class": "hosting", "class_source": "heuristic", "cc": "US" }, "to": { "ip_redacted": "47.79.x.x", "asn": "AS45102", "org": "Alibaba (US) Technology Co.", "class": "cloud", "class_source": "heuristic", "cc": "CN" }, "n": 1 }, { "from": { "ip_redacted": "73.42.x.x", "asn": "AS7922", "org": "Comcast", "class": "residential", "class_source": "verified", "cc": "US" }, "to": { "ip_redacted": "170.62.x.x", "asn": "AS212238", "org": "Datacamp / CDNEXT", "class": "hosting", "class_source": "verified", "cc": "GB" }, "n": 1 }, { "from": { "ip_redacted": "198.11.x.x", "asn": "AS45102", "org": "Alibaba (US) Technology Co.", "class": "cloud", "class_source": "heuristic", "cc": "CN" }, "to": { "ip_redacted": "43.161.x.x", "asn": "AS132203", "org": "Tencent Cloud", "class": "cloud", "class_source": "verified", "cc": "CN" }, "n": 1 }, { "from": { "ip_redacted": "51.158.x.x", "asn": "AS12876", "org": "Scaleway SAS", "class": "cloud", "class_source": "heuristic", "cc": "FR" }, "to": { "ip_redacted": "185.129.x.x", "asn": "AS57860", "org": "Zencurity ApS", "class": "unclassified", "class_source": "heuristic", "cc": "DK" }, "n": 1 }, { "from": { "ip_redacted": "37.114.x.x", "asn": "AS58087", "org": "Florian Kolb", "class": "unclassified", "class_source": "heuristic", "cc": "DE" }, "to": { "ip_redacted": "204.8.x.x", "asn": "AS62744", "org": "Quintex Alliance Consulting", "class": "unclassified", "class_source": "heuristic", "cc": "US" }, "n": 1 }, { "from": { "ip_redacted": "208.84.x.x", "asn": "AS206216", "org": "Advin Services LLC", "class": "unclassified", "class_source": "heuristic", "cc": "US" }, "to": { "ip_redacted": "redacted", "asn": "AS206216", "org": "Advin Services LLC", "class": "unclassified", "class_source": "heuristic", "cc": "US" }, "n": 1 } ], "cdn_note": "29 further incidents are excluded: the bait was fetched through our own Cloudflare edge, so the true client IP was never recorded. They are a CDN artefact, not reuse.", "note": "78 of 86 reuse journeys share AS132203 \u2014 most likely one automated operator, not that many separate actors." } } }