{ "generated_at": "2026-08-05T00:27:03.185565Z", "window_hours": 24, "threat_index": { "value": 52, "label": "GUARDED", "ratio_to_normal": 0.62, "baseline_events_per_day": 1417695, "basis": "last 24h volume against the median of the previous 14 complete days, plus observed high-severity techniques and hands-on activity" }, "kpis": { "events": "990K", "unique_ips": "15,523", "protocols_covered": 22, "continents_covered": 3, "top_technique": { "id": "T1110", "name": "Brute Force", "pct": 38 } }, "hourly_volume": [ 5845, 13485, 7935, 4560, 5782, 14241, 6057, 8169, 7705, 6751, 5946, 7900, 9250, 22528, 12478, 10376, 6506, 3774, 6155, 10710, 6620, 6673, 5305, 4034 ], "windows": { "24h": { "events": "874K", "volume": [ 5845, 13485, 7935, 4560, 5782, 14241, 6057, 8169, 7705, 6751, 5946, 7900, 9250, 22528, 12478, 10376, 6506, 3774, 6155, 10710, 6620, 6673, 5305, 4034 ], "labels": [ "00:00", "01:00", "02:00", "03:00", "04:00", "05:00", "06:00", "07:00", "08:00", "09:00", "10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00", "17:00", "18:00", "19:00", "20:00", "21:00", "22:00", "23:00" ], "unit": "events / hour", "protocols": [ { "name": "RDP", "pct": 38, "amber": false }, { "name": "SCADA-Modbus", "pct": 26, "amber": true }, { "name": "SSL-VPN", "pct": 12, "amber": false }, { "name": "DICOM", "pct": 8, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "Telnet", "pct": 6, "amber": false }, { "name": "WATER", "pct": 3, "amber": false }, { "name": "Other", "pct": 1, "amber": false, "includes": [ "DNP3", "ATG-TLS", "BACnet", "GE-SRTP", "EtherNet/IP", "SSH", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "unique_ips": "2,105", "origins": [ { "name": "United States", "pct": 19 }, { "name": "France", "pct": 11 }, { "name": "Netherlands", "pct": 11 }, { "name": "Germany", "pct": 8 }, { "name": "Panama", "pct": 7 }, { "name": "China", "pct": 6 }, { "name": "United Kingdom", "pct": 6 }, { "name": "Other", "pct": 32 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 19 }, { "name": "France", "lat": 46, "lon": 2, "pct": 11 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 11 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 8 }, { "name": "China", "lat": 35, "lon": 105, "pct": 6 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 6 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 4 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 3 }, { "name": "Vietnam", "lat": 16, "lon": 108, "pct": 2 }, { "name": "India", "lat": 21, "lon": 78, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 2 } ], "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 38 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 23 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 22 }, { "id": "T1021", "name": "Remote Services", "pct": 16 }, { "id": "T1082", "name": "System Information Discovery", "pct": 1 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 0 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 }, { "id": "T1087", "name": "Account Discovery", "pct": 0 }, { "id": "T1210", "name": "Exploitation of Remote Services", "pct": 0 } ], "mitre_observed": { "window": "24h", "enterprise": { "T1110": { "name": "Brute Force", "count": 3026 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 1799 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 1752 }, "T1021": { "name": "Remote Services", "count": 1248 }, "T1082": { "name": "System Information Discovery", "count": 42 }, "T1105": { "name": "Ingress Tool Transfer", "count": 12 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 8 }, "T1087": { "name": "Account Discovery", "count": 5 }, "T1210": { "name": "Exploitation of Remote Services", "count": 2 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 1429 }, "T0842": { "name": "Network Sniffing", "count": 916 }, "T0861": { "name": "Point & Tag Identification", "count": 407 }, "T0801": { "name": "Monitoring Process State", "count": 407 }, "T0886": { "name": "Remote Services", "count": 238 }, "T0888": { "name": "System Firmware", "count": 183 }, "T0812": { "name": "Default Credentials", "count": 93 } } } }, "7d": { "events": "7.9M", "volume": [ 1454518, 1703235, 1782571, 1193666, 928261, 864563, 12739 ], "labels": [ "07-30", "07-31", "08-01", "08-02", "08-03", "08-04", "08-05" ], "unit": "events / day", "protocols": [ { "name": "RDP", "pct": 35, "amber": false }, { "name": "SCADA-Modbus", "pct": 25, "amber": true }, { "name": "SSL-VPN", "pct": 14, "amber": false }, { "name": "Telnet", "pct": 6, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "DICOM", "pct": 5, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 32 }, { "name": "Indonesia", "pct": 20 }, { "name": "Germany", "pct": 9 }, { "name": "United Kingdom", "pct": 8 }, { "name": "Italy", "pct": 6 }, { "name": "United States", "pct": 6 }, { "name": "Bulgaria", "pct": 4 }, { "name": "Other", "pct": 15 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 32 }, { "name": "Indonesia", "lat": -2, "lon": 118, "pct": 20 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 9 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 8 }, { "name": "Italy", "lat": 42, "lon": 12, "pct": 6 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 6 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 4 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 4 }, { "name": "Egypt", "lat": 26, "lon": 30, "pct": 3 }, { "name": "China", "lat": 35, "lon": 105, "pct": 2 }, { "name": "India", "lat": 21, "lon": 78, "pct": 2 }, { "name": "Thailand", "lat": 15, "lon": 101, "pct": 1 } ], "unique_ips": "15,490", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 47 }, { "id": "T1021", "name": "Remote Services", "pct": 37 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 3 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 2 }, { "id": "T0842", "name": "Network Sniffing", "pct": 2 }, { "id": "T0801", "name": "Monitoring Process State", "pct": 2 }, { "id": "T0861", "name": "Point & Tag Identification", "pct": 1 } ], "mitre_observed": { "window": "win", "enterprise": { "T1059": { "name": "Command & Scripting Interpreter", "count": 8307 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 11828 }, "T1110": { "name": "Brute Force", "count": 184406 }, "T1078": { "name": "Valid Accounts", "count": 5211 }, "T1021": { "name": "Remote Services", "count": 144479 }, "T1210": { "name": "Exploitation of Remote Services", "count": 921 }, "T1087": { "name": "Account Discovery", "count": 577 }, "T1187": { "name": "Forced Authentication", "count": 43 } }, "ics": { "T0801": { "name": "Monitoring Process State", "count": 6065 }, "T0846": { "name": "Remote System Discovery", "count": 15390 }, "T0842": { "name": "Network Sniffing", "count": 7594 }, "T0861": { "name": "Point & Tag Identification", "count": 5736 }, "T0812": { "name": "Default Credentials", "count": 93 } } } }, "18d": { "events": "25.7M", "volume": [ 1330383, 1735740, 1251114, 1104222, 1232091, 2328340, 2332642, 1380873, 1373574, 1918083, 1781522, 1454518, 1703235, 1782571, 1193666, 928261, 864563, 12739 ], "labels": [ "07-19", "07-20", "07-21", "07-22", "07-23", "07-24", "07-25", "07-26", "07-27", "07-28", "07-29", "07-30", "07-31", "08-01", "08-02", "08-03", "08-04", "08-05" ], "unit": "events / day", "protocols": [ { "name": "RDP", "pct": 27, "amber": false }, { "name": "SCADA-Modbus", "pct": 25, "amber": true }, { "name": "SSL-VPN", "pct": 13, "amber": false }, { "name": "SSH", "pct": 8, "amber": false }, { "name": "Telnet", "pct": 7, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false } ], "origins": [ { "name": "Netherlands", "pct": 24 }, { "name": "Indonesia", "pct": 21 }, { "name": "Germany", "pct": 13 }, { "name": "China", "pct": 9 }, { "name": "United States", "pct": 5 }, { "name": "United Kingdom", "pct": 4 }, { "name": "Italy", "pct": 4 }, { "name": "Other", "pct": 20 } ], "map_origins": [ { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 24 }, { "name": "Indonesia", "lat": -2, "lon": 118, "pct": 21 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 13 }, { "name": "China", "lat": 35, "lon": 105, "pct": 9 }, { "name": "United States", "lat": 39, "lon": -98, "pct": 5 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 4 }, { "name": "Italy", "lat": 42, "lon": 12, "pct": 4 }, { "name": "Mexico", "lat": 23, "lon": -102, "pct": 3 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 3 }, { "name": "India", "lat": 21, "lon": 78, "pct": 3 }, { "name": "Hong Kong", "lat": 22, "lon": 114, "pct": 2 }, { "name": "Ukraine", "lat": 49, "lon": 32, "pct": 2 } ], "unique_ips": "30,336", "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 44 }, { "id": "T1021", "name": "Remote Services", "pct": 35 }, { "id": "T0846", "name": "Remote System Discovery", "pct": 4 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 4 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 3 }, { "id": "T0842", "name": "Network Sniffing", "pct": 2 }, { "id": "T1078", "name": "Valid Accounts", "pct": 2 }, { "id": "T0812", "name": "Default Credentials", "pct": 2 } ], "mitre_observed": { "window": "win", "enterprise": { "T1190": { "name": "Exploit Public-Facing Application", "count": 36062 }, "T1021": { "name": "Remote Services", "count": 365584 }, "T1210": { "name": "Exploitation of Remote Services", "count": 2701 }, "T1087": { "name": "Account Discovery", "count": 1581 }, "T1110": { "name": "Brute Force", "count": 461410 }, "T1078": { "name": "Valid Accounts", "count": 22059 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 37205 }, "T1187": { "name": "Forced Authentication", "count": 44 } }, "ics": { "T0801": { "name": "Monitoring Process State", "count": 14452 }, "T0846": { "name": "Remote System Discovery", "count": 42919 }, "T0861": { "name": "Point & Tag Identification", "count": 13263 }, "T0842": { "name": "Network Sniffing", "count": 23261 }, "T0812": { "name": "Default Credentials", "count": 20807 } } } } }, "origins": [ { "name": "United States", "pct": 19 }, { "name": "France", "pct": 11 }, { "name": "Netherlands", "pct": 11 }, { "name": "Germany", "pct": 8 }, { "name": "Panama", "pct": 7 }, { "name": "China", "pct": 6 }, { "name": "United Kingdom", "pct": 6 }, { "name": "Other", "pct": 32 } ], "protocols": [ { "name": "RDP", "pct": 38, "amber": false }, { "name": "SCADA-Modbus", "pct": 26, "amber": true }, { "name": "SSL-VPN", "pct": 12, "amber": false }, { "name": "DICOM", "pct": 8, "amber": false }, { "name": "HTTP", "pct": 6, "amber": false }, { "name": "Telnet", "pct": 6, "amber": false }, { "name": "WATER", "pct": 3, "amber": false }, { "name": "Other", "pct": 1, "amber": false, "includes": [ "DNP3", "ATG-TLS", "BACnet", "GE-SRTP", "EtherNet/IP", "SSH", "Arista/EOS", "Dahua/DVR", "Siemens/SCALANCE" ] } ], "credentials": [ { "user": "admin", "pass": "admin123", "count": 99, "app": "Linux / SSH server" }, { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 96, "app": "Linux / SSH server" }, { "user": "user", "pass": "admin2023!", "count": 94, "app": "Linux / SSH server" }, { "user": "admin", "pass": "admin", "count": 68, "app": "Linux / SSH server" }, { "user": "root", "pass": "3245gs5662d34", "count": 44, "app": "Linux / SSH server" }, { "user": "root", "pass": "checking!@!@%", "count": 32, "app": "Linux / SSH server" } ], "credentials_by_appliance": { "Auth / IdP appliance": [ { "user": "admin", "pass": "admin123", "count": 16 }, { "user": "root", "pass": "checking!@!@%", "count": 9 }, { "user": "root", "pass": "123456", "count": 3 }, { "user": "root", "pass": "1234abcd", "count": 3 }, { "user": "firedancer", "pass": "firedancer", "count": 3 }, { "user": "root", "pass": "321", "count": 2 } ], "Linux / SSH server": [ { "user": "user", "pass": "admin2023!", "count": 94 }, { "user": "admin", "pass": "admin123", "count": 81 }, { "user": "admin", "pass": "admin", "count": 64 }, { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 62 }, { "user": "root", "pass": "3245gs5662d34", "count": 31 }, { "user": "admin", "pass": "12345", "count": 15 } ], "Medical imaging (DICOM)": [ { "user": "root", "pass": "checking!@!@%", "count": 4 }, { "user": "admin", "pass": "admin", "count": 2 }, { "user": "root", "pass": "1234abcd", "count": 2 }, { "user": "master", "pass": "master", "count": 2 }, { "user": "root", "pass": "welcome1", "count": 2 }, { "user": "vncuser", "pass": "123456", "count": 2 } ], "Serial console server": [ { "user": "345gs5662d34", "pass": "345gs5662d34", "count": 34 }, { "user": "root", "pass": "3245gs5662d34", "count": 13 }, { "user": "support", "pass": "123456", "count": 8 }, { "user": "root", "pass": "checking!@!@%", "count": 6 }, { "user": "test", "pass": "3245gs5662d34", "count": 3 }, { "user": "admin", "pass": "admin123", "count": 2 } ], "Siemens OT router": [ { "user": ";`cat /etc/passwd`", "pass": "\r\n", "count": 1 }, { "user": "admin", "pass": "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b", "count": 1 } ], "Water SCADA / PLC": [ { "user": "anonymous", "pass": "anonymous@", "count": 4 }, { "user": "PlcmSpIp", "pass": "PlcmSpIp", "count": 3 }, { "user": "anonymous", "pass": "IEUser@", "count": 3 }, { "user": "test", "pass": "test", "count": 2 }, { "user": "guest", "pass": "guest", "count": 2 }, { "user": "ua9ebb2g", "pass": "pIPj47qL", "count": 2 } ], "Windows AD / RDP": [ { "user": "hello", "pass": "", "count": 842 }, { "user": "test", "pass": "", "count": 6 }, { "user": "Test", "pass": "", "count": 6 }, { "user": "devel", "pass": "", "count": 5 }, { "user": "Administrator", "pass": "", "count": 2 }, { "user": "AoHMpEOAk", "pass": "", "count": 1 } ] }, "mitre_observed": { "window": "24h", "enterprise": { "T1110": { "name": "Brute Force", "count": 3026 }, "T1059": { "name": "Command & Scripting Interpreter", "count": 1799 }, "T1190": { "name": "Exploit Public-Facing Application", "count": 1752 }, "T1021": { "name": "Remote Services", "count": 1248 }, "T1082": { "name": "System Information Discovery", "count": 42 }, "T1105": { "name": "Ingress Tool Transfer", "count": 12 }, "T1071": { "name": "Application Layer Protocol (C2)", "count": 8 }, "T1087": { "name": "Account Discovery", "count": 5 }, "T1210": { "name": "Exploitation of Remote Services", "count": 2 } }, "ics": { "T0846": { "name": "Remote System Discovery", "count": 1429 }, "T0842": { "name": "Network Sniffing", "count": 916 }, "T0861": { "name": "Point & Tag Identification", "count": 407 }, "T0801": { "name": "Monitoring Process State", "count": 407 }, "T0886": { "name": "Remote Services", "count": 238 }, "T0888": { "name": "System Firmware", "count": 183 }, "T0812": { "name": "Default Credentials", "count": 93 } } }, "mitre": [ { "id": "T1110", "name": "Brute Force", "pct": 38 }, { "id": "T1059", "name": "Command & Scripting Interpreter", "pct": 23 }, { "id": "T1190", "name": "Exploit Public-Facing Application", "pct": 22 }, { "id": "T1021", "name": "Remote Services", "pct": 16 }, { "id": "T1082", "name": "System Information Discovery", "pct": 1 }, { "id": "T1105", "name": "Ingress Tool Transfer", "pct": 0 }, { "id": "T1071", "name": "Application Layer Protocol (C2)", "pct": 0 }, { "id": "T1087", "name": "Account Discovery", "pct": 0 }, { "id": "T1210", "name": "Exploitation of Remote Services", "pct": 0 } ], "map_origins": [ { "name": "United States", "lat": 39, "lon": -98, "pct": 19 }, { "name": "France", "lat": 46, "lon": 2, "pct": 11 }, { "name": "Netherlands", "lat": 52, "lon": 5, "pct": 11 }, { "name": "Germany", "lat": 51, "lon": 10, "pct": 8 }, { "name": "China", "lat": 35, "lon": 105, "pct": 6 }, { "name": "United Kingdom", "lat": 54, "lon": -2, "pct": 6 }, { "name": "Bulgaria", "lat": 43, "lon": 25, "pct": 4 }, { "name": "Singapore", "lat": 1, "lon": 104, "pct": 3 }, { "name": "Vietnam", "lat": 16, "lon": 108, "pct": 2 }, { "name": "India", "lat": 21, "lon": 78, "pct": 2 }, { "name": "Brazil", "lat": -10, "lon": -52, "pct": 2 } ], "feed": [ { "proto": "SSH", "origin": "NL", "act": "busybox fingerprint -> wget dropper", "arch": "Interactive Session", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "HK", "act": "hands-on session, 7 commands", "arch": "Interactive Session", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "UA", "act": "busybox fingerprint -> wget dropper", "arch": "Automated Session", "ac": "#FFB800" }, { "proto": "SSH", "origin": "CO", "act": "hands-on session, 25 commands", "arch": "Automated Session", "ac": "#FFB800" }, { "proto": "SSH", "origin": "US", "act": "busybox fingerprint -> wget dropper", "arch": "IoT Botnet Dropper", "ac": "#00D4AA" }, { "proto": "SSH", "origin": "AD", "act": "hardware probe -> miner deploy attempt", "arch": "Cryptominer Deployment", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "US", "act": "Barracuda/SCALANCE login attempt, 8 tries", "arch": "Credential Spray", "ac": "#00D4AA" }, { "proto": "HTTP", "origin": "GB", "act": "Barracuda/SCALANCE login attempt, 11 tries", "arch": "Credential Spray", "ac": "#00D4AA" } ], "nuisance_filtered": 5477, "captures": { "window_days": 12, "events": 11882038, "sessions": 526397, "unique_ips": 15523, "events_24h": 874067, "sessions_24h": 97626, "unique_ips_24h": 4156, "per_day": 990170, "per_week": 6931189, "per_month": 29705095, "alltime_estimate": 52831647, "alltime_floor": 52000000 }, "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 2h and redacted.", "canary": { "updated_at": "2026-08-05T00:26:38Z", "tokens_planted": 4197, "bait_grab_ips": 225, "detonations_total": 91, "detonation_ips": 32, "incidents_total": 31, "incidents_cross_ip_reuse": 18, "recent_detonations": [ { "ts": "2026-08-03T02:19:58Z", "geo": "NL", "asn": "AS34343", "flavor": "http", "ua_class": "tool/scanner", "ip_redacted": "81.171.x.x" }, { "ts": "2026-08-02T22:25:11Z", "geo": "DE", "asn": "AS14061", "flavor": "http", "ua_class": "browser", "ip_redacted": "207.154.x.x" }, { "ts": "2026-08-02T22:25:03Z", "geo": "GB", "asn": "AS14061", "flavor": "http", "ua_class": "browser", "ip_redacted": "206.189.x.x" }, { "ts": "2026-08-02T22:25:03Z", "geo": "CA", "asn": "AS14061", "flavor": "http", "ua_class": "browser", "ip_redacted": "147.182.x.x" }, { "ts": "2026-08-02T12:35:36Z", "geo": "TH", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.164.x.x" }, { "ts": "2026-08-02T08:36:47Z", "geo": "BR", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.157.x.x" }, { "ts": "2026-08-02T07:58:13Z", "geo": "DE", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "43.165.x.x" }, { "ts": "2026-08-02T07:29:00Z", "geo": "US", "asn": "AS132203", "flavor": "http", "ua_class": "browser", "ip_redacted": "170.106.x.x" } ] } }