{
  "generated_at": "2026-07-27T06:36:54.066769Z",
  "window_hours": 24,
  "threat_index": {
    "value": 95,
    "label": "SEVERE",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "1.1M",
    "unique_ips": "13,291",
    "protocols_covered": 20,
    "continents_covered": 3,
    "top_technique": {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 32
    }
  },
  "hourly_volume": [
    6273,
    4731,
    6266,
    4288,
    4223,
    11120,
    7635,
    6450,
    4433,
    7386,
    6171,
    7268,
    4478,
    3781,
    5275,
    6155,
    6371,
    5890,
    8031,
    5184,
    7621,
    9599,
    9800,
    6291
  ],
  "windows": {
    "24h": {
      "events": "873K",
      "volume": [
        6273,
        4731,
        6266,
        4288,
        4223,
        11120,
        7635,
        6450,
        4433,
        7386,
        6171,
        7268,
        4478,
        3781,
        5275,
        6155,
        6371,
        5890,
        8031,
        5184,
        7621,
        9599,
        9800,
        6291
      ],
      "labels": [
        "00:00",
        "01:00",
        "02:00",
        "03:00",
        "04:00",
        "05:00",
        "06:00",
        "07:00",
        "08:00",
        "09:00",
        "10:00",
        "11:00",
        "12:00",
        "13:00",
        "14:00",
        "15:00",
        "16:00",
        "17:00",
        "18:00",
        "19:00",
        "20:00",
        "21:00",
        "22:00",
        "23:00"
      ],
      "unit": "events / hour",
      "protocols": [
        {
          "name": "SCADA-Modbus",
          "pct": 32,
          "amber": true
        },
        {
          "name": "RDP",
          "pct": 23,
          "amber": false
        },
        {
          "name": "SSL-VPN",
          "pct": 14,
          "amber": false
        },
        {
          "name": "Telnet",
          "pct": 13,
          "amber": false
        },
        {
          "name": "DICOM",
          "pct": 8,
          "amber": false
        },
        {
          "name": "HTTP",
          "pct": 7,
          "amber": false
        },
        {
          "name": "WATER",
          "pct": 3,
          "amber": false
        },
        {
          "name": "Other",
          "pct": 2,
          "amber": false,
          "includes": [
            "DNP3",
            "ATG-TLS",
            "BACnet",
            "GE-SRTP",
            "EtherNet/IP",
            "SSH",
            "Dahua/DVR"
          ]
        }
      ],
      "unique_ips": "2,059",
      "origins": [
        {
          "name": "United States",
          "pct": 23
        },
        {
          "name": "Netherlands",
          "pct": 18
        },
        {
          "name": "Germany",
          "pct": 8
        },
        {
          "name": "China",
          "pct": 7
        },
        {
          "name": "United Kingdom",
          "pct": 5
        },
        {
          "name": "India",
          "pct": 5
        },
        {
          "name": "Panama",
          "pct": 4
        },
        {
          "name": "Other",
          "pct": 30
        }
      ],
      "map_origins": [
        {
          "name": "United States",
          "lat": 39,
          "lon": -98,
          "pct": 23
        },
        {
          "name": "Netherlands",
          "lat": 52,
          "lon": 5,
          "pct": 18
        },
        {
          "name": "Germany",
          "lat": 51,
          "lon": 10,
          "pct": 8
        },
        {
          "name": "China",
          "lat": 35,
          "lon": 105,
          "pct": 7
        },
        {
          "name": "United Kingdom",
          "lat": 54,
          "lon": -2,
          "pct": 5
        },
        {
          "name": "India",
          "lat": 21,
          "lon": 78,
          "pct": 5
        },
        {
          "name": "Indonesia",
          "lat": -2,
          "lon": 118,
          "pct": 3
        },
        {
          "name": "France",
          "lat": 46,
          "lon": 2,
          "pct": 3
        },
        {
          "name": "Brazil",
          "lat": -10,
          "lon": -52,
          "pct": 2
        },
        {
          "name": "Vietnam",
          "lat": 16,
          "lon": 108,
          "pct": 2
        },
        {
          "name": "Singapore",
          "lat": 1,
          "lon": 104,
          "pct": 2
        }
      ],
      "mitre": [
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "pct": 32
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "pct": 26
        },
        {
          "id": "T1059",
          "name": "Command & Scripting Interpreter",
          "pct": 22
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "pct": 18
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "pct": 1
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "pct": 0
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol (C2)",
          "pct": 0
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "pct": 0
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "pct": 0
        }
      ],
      "mitre_observed": {
        "window": "24h",
        "enterprise": {
          "T1190": {
            "name": "Exploit Public-Facing Application",
            "count": 2144
          },
          "T1110": {
            "name": "Brute Force",
            "count": 1695
          },
          "T1059": {
            "name": "Command & Scripting Interpreter",
            "count": 1441
          },
          "T1021": {
            "name": "Remote Services",
            "count": 1224
          },
          "T1082": {
            "name": "System Information Discovery",
            "count": 92
          },
          "T1210": {
            "name": "Exploitation of Remote Services",
            "count": 18
          },
          "T1071": {
            "name": "Application Layer Protocol (C2)",
            "count": 13
          },
          "T1105": {
            "name": "Ingress Tool Transfer",
            "count": 3
          },
          "T1087": {
            "name": "Account Discovery",
            "count": 1
          }
        },
        "ics": {
          "T0846": {
            "name": "Remote System Discovery",
            "count": 1412
          },
          "T0842": {
            "name": "Network Sniffing",
            "count": 993
          },
          "T0861": {
            "name": "Point & Tag Identification",
            "count": 419
          },
          "T0801": {
            "name": "Monitoring Process State",
            "count": 419
          },
          "T0886": {
            "name": "Remote Services",
            "count": 42
          }
        }
      }
    },
    "7d": {
      "events": "9.3M",
      "volume": [
        1251114,
        1104222,
        1232091,
        2328340,
        2028820,
        1208390,
        187243
      ],
      "labels": [
        "07-21",
        "07-22",
        "07-23",
        "07-24",
        "07-25",
        "07-26",
        "07-27"
      ],
      "unit": "events / day",
      "protocols": [
        {
          "name": "SCADA-Modbus",
          "pct": 27,
          "amber": true
        },
        {
          "name": "RDP",
          "pct": 25,
          "amber": false
        },
        {
          "name": "SSL-VPN",
          "pct": 13,
          "amber": false
        },
        {
          "name": "Telnet",
          "pct": 9,
          "amber": false
        },
        {
          "name": "SSH",
          "pct": 8,
          "amber": false
        },
        {
          "name": "HTTP",
          "pct": 7,
          "amber": false
        }
      ],
      "origins": [
        {
          "name": "Netherlands",
          "pct": 38
        },
        {
          "name": "China",
          "pct": 14
        },
        {
          "name": "Italy",
          "pct": 8
        },
        {
          "name": "Indonesia",
          "pct": 8
        },
        {
          "name": "Mexico",
          "pct": 8
        },
        {
          "name": "United Kingdom",
          "pct": 7
        },
        {
          "name": "Bulgaria",
          "pct": 4
        },
        {
          "name": "Other",
          "pct": 13
        }
      ],
      "map_origins": [
        {
          "name": "Netherlands",
          "lat": 52,
          "lon": 5,
          "pct": 38
        },
        {
          "name": "China",
          "lat": 35,
          "lon": 105,
          "pct": 14
        },
        {
          "name": "Italy",
          "lat": 42,
          "lon": 12,
          "pct": 8
        },
        {
          "name": "Indonesia",
          "lat": -2,
          "lon": 118,
          "pct": 8
        },
        {
          "name": "Mexico",
          "lat": 23,
          "lon": -102,
          "pct": 8
        },
        {
          "name": "United Kingdom",
          "lat": 54,
          "lon": -2,
          "pct": 7
        },
        {
          "name": "Bulgaria",
          "lat": 43,
          "lon": 25,
          "pct": 4
        },
        {
          "name": "United States",
          "lat": 39,
          "lon": -98,
          "pct": 4
        },
        {
          "name": "Vietnam",
          "lat": 16,
          "lon": 108,
          "pct": 3
        },
        {
          "name": "India",
          "lat": 21,
          "lon": 78,
          "pct": 2
        },
        {
          "name": "Germany",
          "lat": 51,
          "lon": 10,
          "pct": 1
        },
        {
          "name": "Brazil",
          "lat": -10,
          "lon": -52,
          "pct": 1
        }
      ],
      "unique_ips": "15,073",
      "mitre": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "pct": 43
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "pct": 31
        },
        {
          "id": "T1059",
          "name": "Command & Scripting Interpreter",
          "pct": 5
        },
        {
          "id": "T0846",
          "name": "Remote System Discovery",
          "pct": 5
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "pct": 4
        },
        {
          "id": "T1078",
          "name": "Valid Accounts",
          "pct": 3
        },
        {
          "id": "T0842",
          "name": "Network Sniffing",
          "pct": 3
        },
        {
          "id": "T0812",
          "name": "Default Credentials",
          "pct": 3
        }
      ],
      "mitre_observed": {
        "window": "win",
        "enterprise": {
          "T1110": {
            "name": "Brute Force",
            "count": 143767
          },
          "T1059": {
            "name": "Command & Scripting Interpreter",
            "count": 17135
          },
          "T1078": {
            "name": "Valid Accounts",
            "count": 10142
          },
          "T1190": {
            "name": "Exploit Public-Facing Application",
            "count": 13515
          },
          "T1021": {
            "name": "Remote Services",
            "count": 103537
          },
          "T1087": {
            "name": "Account Discovery",
            "count": 596
          },
          "T1210": {
            "name": "Exploitation of Remote Services",
            "count": 1178
          }
        },
        "ics": {
          "T0846": {
            "name": "Remote System Discovery",
            "count": 15888
          },
          "T0812": {
            "name": "Default Credentials",
            "count": 8989
          },
          "T0801": {
            "name": "Monitoring Process State",
            "count": 4615
          },
          "T0861": {
            "name": "Point & Tag Identification",
            "count": 4324
          },
          "T0842": {
            "name": "Network Sniffing",
            "count": 9285
          }
        }
      }
    },
    "18d": {
      "events": "16M",
      "volume": [
        386989,
        574934,
        411829,
        509335,
        606588,
        627856,
        157174,
        250945,
        79066,
        1330383,
        1735740,
        1251114,
        1104222,
        1232091,
        2328340,
        2028820,
        1208390,
        187243
      ],
      "labels": [
        "07-10",
        "07-11",
        "07-12",
        "07-13",
        "07-14",
        "07-15",
        "07-16",
        "07-17",
        "07-18",
        "07-19",
        "07-20",
        "07-21",
        "07-22",
        "07-23",
        "07-24",
        "07-25",
        "07-26",
        "07-27"
      ],
      "unit": "events / day",
      "protocols": [
        {
          "name": "SCADA-Modbus",
          "pct": 25,
          "amber": true
        },
        {
          "name": "Telnet",
          "pct": 23,
          "amber": false
        },
        {
          "name": "SSH",
          "pct": 15,
          "amber": false
        },
        {
          "name": "SSL-VPN",
          "pct": 11,
          "amber": false
        },
        {
          "name": "RDP",
          "pct": 8,
          "amber": false
        },
        {
          "name": "HTTP",
          "pct": 6,
          "amber": false
        }
      ],
      "origins": [
        {
          "name": "Netherlands",
          "pct": 43
        },
        {
          "name": "China",
          "pct": 10
        },
        {
          "name": "United States",
          "pct": 9
        },
        {
          "name": "Germany",
          "pct": 7
        },
        {
          "name": "Poland",
          "pct": 5
        },
        {
          "name": "United Kingdom",
          "pct": 3
        },
        {
          "name": "Indonesia",
          "pct": 3
        },
        {
          "name": "Other",
          "pct": 20
        }
      ],
      "map_origins": [
        {
          "name": "Netherlands",
          "lat": 52,
          "lon": 5,
          "pct": 43
        },
        {
          "name": "China",
          "lat": 35,
          "lon": 105,
          "pct": 10
        },
        {
          "name": "United States",
          "lat": 39,
          "lon": -98,
          "pct": 9
        },
        {
          "name": "Germany",
          "lat": 51,
          "lon": 10,
          "pct": 7
        },
        {
          "name": "Poland",
          "lat": 52,
          "lon": 19,
          "pct": 5
        },
        {
          "name": "United Kingdom",
          "lat": 54,
          "lon": -2,
          "pct": 3
        },
        {
          "name": "Indonesia",
          "lat": -2,
          "lon": 118,
          "pct": 3
        },
        {
          "name": "Italy",
          "lat": 42,
          "lon": 12,
          "pct": 3
        },
        {
          "name": "Mexico",
          "lat": 23,
          "lon": -102,
          "pct": 3
        },
        {
          "name": "Bulgaria",
          "lat": 43,
          "lon": 25,
          "pct": 2
        },
        {
          "name": "Ukraine",
          "lat": 49,
          "lon": 32,
          "pct": 2
        },
        {
          "name": "Singapore",
          "lat": 1,
          "lon": 104,
          "pct": 1
        }
      ],
      "unique_ips": "22,542",
      "mitre": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "pct": 50
        },
        {
          "id": "T1021",
          "name": "Remote Services",
          "pct": 23
        },
        {
          "id": "T1059",
          "name": "Command & Scripting Interpreter",
          "pct": 7
        },
        {
          "id": "T0812",
          "name": "Default Credentials",
          "pct": 5
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "pct": 4
        },
        {
          "id": "T0846",
          "name": "Remote System Discovery",
          "pct": 4
        },
        {
          "id": "T1078",
          "name": "Valid Accounts",
          "pct": 3
        },
        {
          "id": "T0842",
          "name": "Network Sniffing",
          "pct": 2
        }
      ],
      "mitre_observed": {
        "window": "win",
        "enterprise": {
          "T1059": {
            "name": "Command & Scripting Interpreter",
            "count": 43058
          },
          "T1110": {
            "name": "Brute Force",
            "count": 328904
          },
          "T1190": {
            "name": "Exploit Public-Facing Application",
            "count": 23652
          },
          "T1078": {
            "name": "Valid Accounts",
            "count": 21235
          },
          "T1021": {
            "name": "Remote Services",
            "count": 148636
          },
          "T1210": {
            "name": "Exploitation of Remote Services",
            "count": 1375
          },
          "T1087": {
            "name": "Account Discovery",
            "count": 742
          },
          "T1187": {
            "name": "Forced Authentication",
            "count": 1
          }
        },
        "ics": {
          "T0801": {
            "name": "Monitoring Process State",
            "count": 7837
          },
          "T0846": {
            "name": "Remote System Discovery",
            "count": 23021
          },
          "T0861": {
            "name": "Point & Tag Identification",
            "count": 7080
          },
          "T0812": {
            "name": "Default Credentials",
            "count": 34193
          },
          "T0842": {
            "name": "Network Sniffing",
            "count": 12268
          }
        }
      }
    }
  },
  "origins": [
    {
      "name": "United States",
      "pct": 23
    },
    {
      "name": "Netherlands",
      "pct": 18
    },
    {
      "name": "Germany",
      "pct": 8
    },
    {
      "name": "China",
      "pct": 7
    },
    {
      "name": "United Kingdom",
      "pct": 5
    },
    {
      "name": "India",
      "pct": 5
    },
    {
      "name": "Panama",
      "pct": 4
    },
    {
      "name": "Other",
      "pct": 30
    }
  ],
  "protocols": [
    {
      "name": "SCADA-Modbus",
      "pct": 32,
      "amber": true
    },
    {
      "name": "RDP",
      "pct": 23,
      "amber": false
    },
    {
      "name": "SSL-VPN",
      "pct": 14,
      "amber": false
    },
    {
      "name": "Telnet",
      "pct": 13,
      "amber": false
    },
    {
      "name": "DICOM",
      "pct": 8,
      "amber": false
    },
    {
      "name": "HTTP",
      "pct": 7,
      "amber": false
    },
    {
      "name": "WATER",
      "pct": 3,
      "amber": false
    },
    {
      "name": "Other",
      "pct": 2,
      "amber": false,
      "includes": [
        "DNP3",
        "ATG-TLS",
        "BACnet",
        "GE-SRTP",
        "EtherNet/IP",
        "SSH",
        "Dahua/DVR"
      ]
    }
  ],
  "credentials": [
    {
      "user": "admin",
      "pass": "admin123",
      "count": 89,
      "app": "Linux / SSH server"
    },
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34",
      "count": 53,
      "app": "Linux / SSH server"
    },
    {
      "user": "admin",
      "pass": "admin",
      "count": 28,
      "app": "Linux / SSH server"
    },
    {
      "user": "root",
      "pass": "3245gs5662d34",
      "count": 22,
      "app": "Linux / SSH server"
    },
    {
      "user": "root",
      "pass": "1234",
      "count": 16,
      "app": "Linux / SSH server"
    },
    {
      "user": "anonymous",
      "pass": "anonymous@",
      "count": 9
    }
  ],
  "credentials_by_appliance": {
    "Auth / IdP appliance": [
      {
        "user": "gerencia",
        "pass": "gerencia",
        "count": 4
      },
      {
        "user": "team1",
        "pass": "123456",
        "count": 4
      },
      {
        "user": "root",
        "pass": "9090",
        "count": 4
      },
      {
        "user": "root",
        "pass": "kamikaze",
        "count": 4
      },
      {
        "user": "root",
        "pass": "Support@2025",
        "count": 4
      },
      {
        "user": "root",
        "pass": "a4b3c2d1",
        "count": 4
      }
    ],
    "Linux / SSH server": [
      {
        "user": "admin",
        "pass": "admin123",
        "count": 87
      },
      {
        "user": "345gs5662d34",
        "pass": "345gs5662d34",
        "count": 46
      },
      {
        "user": "admin",
        "pass": "admin",
        "count": 27
      },
      {
        "user": "root",
        "pass": "3245gs5662d34",
        "count": 19
      },
      {
        "user": "root",
        "pass": "1234",
        "count": 14
      },
      {
        "user": "support",
        "pass": "123456789",
        "count": 8
      }
    ],
    "Serial console server": [
      {
        "user": "345gs5662d34",
        "pass": "345gs5662d34",
        "count": 7
      },
      {
        "user": "root",
        "pass": "eve",
        "count": 3
      },
      {
        "user": "root",
        "pass": "3245gs5662d34",
        "count": 3
      },
      {
        "user": "ftp",
        "pass": "ftp123",
        "count": 3
      },
      {
        "user": "oscar",
        "pass": "oscar",
        "count": 3
      },
      {
        "user": "frappe",
        "pass": "frappe",
        "count": 3
      }
    ]
  },
  "mitre_observed": {
    "window": "24h",
    "enterprise": {
      "T1190": {
        "name": "Exploit Public-Facing Application",
        "count": 2144
      },
      "T1110": {
        "name": "Brute Force",
        "count": 1695
      },
      "T1059": {
        "name": "Command & Scripting Interpreter",
        "count": 1441
      },
      "T1021": {
        "name": "Remote Services",
        "count": 1224
      },
      "T1082": {
        "name": "System Information Discovery",
        "count": 92
      },
      "T1210": {
        "name": "Exploitation of Remote Services",
        "count": 18
      },
      "T1071": {
        "name": "Application Layer Protocol (C2)",
        "count": 13
      },
      "T1105": {
        "name": "Ingress Tool Transfer",
        "count": 3
      },
      "T1087": {
        "name": "Account Discovery",
        "count": 1
      }
    },
    "ics": {
      "T0846": {
        "name": "Remote System Discovery",
        "count": 1412
      },
      "T0842": {
        "name": "Network Sniffing",
        "count": 993
      },
      "T0861": {
        "name": "Point & Tag Identification",
        "count": 419
      },
      "T0801": {
        "name": "Monitoring Process State",
        "count": 419
      },
      "T0886": {
        "name": "Remote Services",
        "count": 42
      }
    }
  },
  "mitre": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 32
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "pct": 26
    },
    {
      "id": "T1059",
      "name": "Command & Scripting Interpreter",
      "pct": 22
    },
    {
      "id": "T1021",
      "name": "Remote Services",
      "pct": 18
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "pct": 1
    },
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "pct": 0
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol (C2)",
      "pct": 0
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "pct": 0
    },
    {
      "id": "T1087",
      "name": "Account Discovery",
      "pct": 0
    }
  ],
  "map_origins": [
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 23
    },
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 18
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 8
    },
    {
      "name": "China",
      "lat": 35,
      "lon": 105,
      "pct": 7
    },
    {
      "name": "United Kingdom",
      "lat": 54,
      "lon": -2,
      "pct": 5
    },
    {
      "name": "India",
      "lat": 21,
      "lon": 78,
      "pct": 5
    },
    {
      "name": "Indonesia",
      "lat": -2,
      "lon": 118,
      "pct": 3
    },
    {
      "name": "France",
      "lat": 46,
      "lon": 2,
      "pct": 3
    },
    {
      "name": "Brazil",
      "lat": -10,
      "lon": -52,
      "pct": 2
    },
    {
      "name": "Vietnam",
      "lat": 16,
      "lon": 108,
      "pct": 2
    },
    {
      "name": "Singapore",
      "lat": 1,
      "lon": 104,
      "pct": 2
    }
  ],
  "feed": [
    {
      "proto": "SSH",
      "origin": "BE",
      "act": "hands-on session, 6 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "CH",
      "act": "hands-on session, 10 commands",
      "arch": "Human Attacker",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "NL",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Agentic Attacker",
      "ac": "#FFB800"
    },
    {
      "proto": "SSH",
      "origin": "NL",
      "act": "busybox fingerprint -> wget dropper",
      "arch": "Mirai / IoT Botnet",
      "ac": "#00D4AA"
    },
    {
      "proto": "SSH",
      "origin": "JP",
      "act": "hardware probe -> miner deploy attempt",
      "arch": "Cryptominer Operator",
      "ac": "#00D4AA"
    },
    {
      "proto": "HTTP",
      "origin": "US",
      "act": "Barracuda/SCALANCE login attempt, 1 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "HTTP",
      "origin": "GB",
      "act": "Barracuda/SCALANCE login attempt, 6 tries",
      "arch": "OT Appliance Login",
      "ac": "#00D4AA"
    },
    {
      "proto": "SNMP",
      "origin": "US",
      "act": "SNMP walk: sysDescr, ifTable, enterprise OIDs",
      "arch": "OT / SNMP Recon",
      "ac": "#FFB800"
    }
  ],
  "nuisance_filtered": 3529,
  "captures": {
    "window_days": 10,
    "events": 11195612,
    "sessions": 350158,
    "unique_ips": 13291,
    "events_24h": 872905,
    "sessions_24h": 75735,
    "unique_ips_24h": 4028,
    "per_day": 1119561,
    "per_week": 7836928,
    "per_month": 33586836,
    "alltime_estimate": 39529853,
    "alltime_floor": 39000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.",
  "canary": {
    "updated_at": "2026-07-27T06:32:36Z",
    "tokens_planted": 3340,
    "bait_grab_ips": 131,
    "detonations_total": 62,
    "detonation_ips": 18,
    "incidents_total": 19,
    "incidents_cross_ip_reuse": 13,
    "recent_detonations": [
      {
        "ts": "2026-07-21T08:23:25Z",
        "geo": "HK",
        "asn": "AS61112",
        "flavor": "http",
        "ua_class": "tool/scanner",
        "ip_redacted": "154.83.x.x"
      },
      {
        "ts": "2026-07-20T10:39:26Z",
        "geo": "US",
        "asn": "AS142430",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "103.168.x.x"
      },
      {
        "ts": "2026-07-19T06:15:37Z",
        "geo": "SE",
        "asn": "AS212238",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "193.203.x.x"
      },
      {
        "ts": "2026-07-18T15:32:44Z",
        "geo": "SE",
        "asn": "AS212238",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "193.203.x.x"
      },
      {
        "ts": "2026-07-18T10:07:20Z",
        "geo": "BR",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.157.x.x"
      },
      {
        "ts": "2026-07-18T10:00:15Z",
        "geo": "DE",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "162.62.x.x"
      },
      {
        "ts": "2026-07-18T09:50:05Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "170.106.x.x"
      },
      {
        "ts": "2026-07-18T09:10:46Z",
        "geo": "US",
        "asn": "AS132203",
        "flavor": "http",
        "ua_class": "browser",
        "ip_redacted": "43.153.x.x"
      }
    ]
  }
}