{ "generated_at": "2026-07-17T06:23:29.055085Z", "window_hours": 24, "threat_index": { "value": 78, "label": "ELEVATED", "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity" }, "kpis": { "events": "126K", "unique_ips": "6,240", "protocols_covered": 7, "continents_covered": 3, "top_technique": { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 63 } }, "hourly_volume": [ 2772, 4285, 1963, 2449, 3535, 2744, 1706, 2960, 3282, 1528, 1336, 3036, 3526, 1141, 1364, 1304, 1423, 1787, 1860, 3031, 2702, 4123, 2160, 1941 ], "windows": { "24h": { "events": "58K", "volume": [ 2772, 4285, 1963, 2449, 3535, 2744, 1706, 2960, 3282, 1528, 1336, 3036, 3526, 1141, 1364, 1304, 1423, 1787, 1860, 3031, 2702, 4123, 2160, 1941 ], "labels": [ "00:00", "01:00", "02:00", "03:00", "04:00", "05:00", "06:00", "07:00", "08:00", "09:00", "10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00", "17:00", "18:00", "19:00", "20:00", "21:00", "22:00", "23:00" ], "unit": "events / hour", "protocols": [ { "name": "SSL-VPN", "pct": 35, "amber": false }, { "name": "HTTP", "pct": 24, "amber": false }, { "name": "DICOM", "pct": 20, "amber": false }, { "name": "Telnet", "pct": 20, "amber": false }, { "name": "SCADA-Modbus", "pct": 1, "amber": true } ], "unique_ips": "1,038", "origins": [ { "name": "India", "pct": 39 }, { "name": "United States", "pct": 16 }, { "name": "Netherlands", "pct": 11 }, { "name": "United Kingdom", "pct": 4 }, { "name": "Germany", "pct": 4 }, { "name": "Other", "pct": 26 } ], "map_origins": [ { "name": "India", "lat": 21, "lon": 78, "pct": 39 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 16 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 11 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 4 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 4 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 4 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "Canada", "lat": 56, "lon": -106, "pct": 2 }, { "name": "Vietnam", "lat": 16, "lon": 108, "pct": 2 }, { "name": "France", "lat": 46, "lon": 2, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 1 } ] }, "7d": { "events": "2.9M", "volume": [ 574934, 411829, 509335, 606588, 627856, 110265, 26443 ], "labels": [ "07-11", "07-12", "07-13", "07-14", "07-15", "07-16", "07-17" ], "unit": "events / day", "protocols": [ { "name": "Telnet", "pct": 39, "amber": false }, { "name": "SCADA-Modbus", "pct": 22, "amber": true }, { "name": "SSH", "pct": 21, "amber": false }, { "name": "SSL-VPN", "pct": 9, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "DICOM", "pct": 4, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 55 }, { "name": "United States", "pct": 12 }, { "name": "Poland", "pct": 8 }, { "name": "China", "pct": 5 }, { "name": "United Kingdom", "pct": 5 }, { "name": "Other", "pct": 15 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 55 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 12 }, { "name": "Poland", "lat": 52, "lon": 19, "pct": 8 }, { "name": "China", "lat": 35, "lon": 105, "pct": 5 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 5 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 3 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "France", "lat": 46, "lon": 2, "pct": 2 }, { "name": "Colombia", "lat": 4, "lon": -72, "pct": 2 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 2 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Turkey", "lat": 39, "lon": 35, "pct": 1 } ], "unique_ips": "7,916" }, "18d": { "events": "4.5M", "volume": [ 51517, 54355, 41648, 110635, 46783, 45005, 173523, 201059, 220838, 320951, 386989, 574934, 411829, 509335, 606588, 627856, 110265, 26443 ], "labels": [ "06-30", "07-01", "07-02", "07-03", "07-04", "07-05", "07-06", "07-07", "07-08", "07-09", "07-10", "07-11", "07-12", "07-13", "07-14", "07-15", "07-16", "07-17" ], "unit": "events / day", "protocols": [ { "name": "Telnet", "pct": 32, "amber": false }, { "name": "SCADA-Modbus", "pct": 29, "amber": true }, { "name": "SSH", "pct": 21, "amber": false }, { "name": "SSL-VPN", "pct": 9, "amber": false }, { "name": "HTTP", "pct": 5, "amber": false }, { "name": "DICOM", "pct": 4, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 55 }, { "name": "United States", "pct": 12 }, { "name": "Poland", "pct": 8 }, { "name": "China", "pct": 5 }, { "name": "United Kingdom", "pct": 5 }, { "name": "Other", "pct": 15 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 55 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 12 }, { "name": "Poland", "lat": 52, "lon": 19, "pct": 8 }, { "name": "China", "lat": 35, "lon": 105, "pct": 5 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 5 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 3 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "France", "lat": 46, "lon": 2, "pct": 2 }, { "name": "Colombia", "lat": 4, "lon": -72, "pct": 2 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 2 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Turkey", "lat": 39, "lon": 35, "pct": 1 } ], "unique_ips": "8,143" } }, "origins": [ { "name": "India", "pct": 39 }, { "name": "United States", "pct": 16 }, { "name": "Netherlands", "pct": 11 }, { "name": "United Kingdom", "pct": 4 }, { "name": "Germany", "pct": 4 }, { "name": "Other", "pct": 26 } ], "protocols": [ { "name": "SSL-VPN", "pct": 35, "amber": false }, { "name": "HTTP", "pct": 24, "amber": false }, { "name": "DICOM", "pct": 20, "amber": false }, { "name": "Telnet", "pct": 20, "amber": false }, { "name": "SCADA-Modbus", "pct": 1, "amber": true } ], "credentials": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 219, "app": "Linux / SSH server" }, { "user": "admin", "pass": "admin", "count": 127, "app": "Linux / SSH server" }, { "user": "root", "pass": "root123", "count": 100, "app": "Telnet / IoT device" }, { "user": "root", "pass": "3245gs5662d34", "count": 87, "app": "Linux / SSH server" }, { "user": "root", "pass": "root", "count": 85, "app": "Telnet / IoT device" }, { "user": "root", "pass": "checking!@!@%", "count": 66, "app": "Linux / SSH server" } ], "mitre": [ { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 63 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 22 }, { "id": "T1110", "name": "Brute Force", "pct": 9 }, { "id": "T1082", "name": "System Information Discovery", "pct": 5 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 0 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 } ], "map_origins": [ { "name": "India", "lat": 21, "lon": 78, "pct": 39 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 16 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 11 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 4 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 4 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 4 }, { "name": "South Korea", "lat": 37, "lon": 128, "pct": 2 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "Canada", "lat": 56, "lon": -106, "pct": 2 }, { "name": "Vietnam", "lat": 16, "lon": 108, "pct": 2 }, { "name": "France", "lat": 46, "lon": 2, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 1 } ], "feed": [ { "proto": "SSH", "origin": "HK", "act": "1 auth attempts, 5 commands", "arch": "Human Attacker", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "NL", "act": "busybox fingerprint -> wget dropper", "arch": "Agentic Attacker", "ac": "#FFB800" }, { "proto": "SSH", "origin": "SG", "act": "hands-on session, 7 commands", "arch": "Human Attacker", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "LY", "act": "recon then credential-store read", "arch": "Agentic Attacker", "ac": "#FFB800" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 1 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "AD", "act": "busybox fingerprint -> wget dropper", "arch": "Mirai / IoT Botnet", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 3 tries", "arch": "OT Appliance Login", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "BR", "act": "Barracuda/SCALANCE login attempt, 9 tries", "arch": "Credential-Spray Bot", "ac": "#00D4AA" } ], "nuisance_filtered": 8346, "captures": { "window_days": 10, "events": 1258901, "sessions": 343982, "unique_ips": 6240, "per_day": 125890, "per_week": 881231, "per_month": 3776703, "alltime_estimate": 27024476, "alltime_floor": 27000000 }, "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.", "canary": { "updated_at": "2026-07-17T06:23:26Z", "tokens_planted": 707, "bait_grab_ips": 52, "detonations_total": 12, "detonation_ips": 5, "incidents_total": 9, "incidents_cross_ip_reuse": 4, "recent_detonations": [ { "ts": "2026-07-11T17:27:23Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.159.x.x" }, { "ts": "2026-07-11T17:13:31Z", "geo": "BR", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.157.x.x" }, { "ts": "2026-07-11T14:23:55Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "170.106.x.x" }, { "ts": "2026-07-11T02:26:36Z", "geo": "NL", "asn": "AS48090", "flavor": "http", "ua_class": "tool/scanner", "ip_redacted": "195.178.x.x" } ] } }