{"schema":1,"generated_at":"2026-10-21T02:34:32Z","window":{"hours":168,"first_hour":"2026-10-14T03:00:00Z","last_hour":"2026-10-21T02:00:00Z"},"status":{"counted_since":"2026-10-13T04:00:00Z","complete":true,"caught_up":true,"classified_through":"2026-10-21T02:34:32Z"},"measures":{"connections":5025215,"password_guesses":4710554,"guesses_let_in":138724,"left_without_guessing":320753,"sessions_with_commands":131565},"types":[{"slug":"iot-botnet","name":"Router and camera botnet","summary":"Probably an infected router or video recorder. It logs in with a factory password, types the words that open a Linux shell, looks for a folder it can write to and tries to download and run a copy of itself.","page":"/attacks/iot-botnet","sessions":130750,"addresses":292,"daily":[{"day":"2026-10-14","n":14837,"partial":true},{"day":"2026-10-15","n":14659,"partial":false},{"day":"2026-10-16","n":20679,"partial":false},{"day":"2026-10-17","n":16852,"partial":false},{"day":"2026-10-18","n":24520,"partial":false},{"day":"2026-10-19","n":18372,"partial":false},{"day":"2026-10-20","n":18445,"partial":false},{"day":"2026-10-21","n":2386,"partial":true}]},{"slug":"ssh-key-backdoor","name":"SSH key backdoor","summary":"Tries to swap the account's SSH keys for the attacker's so it can come back after the password changes, then tries to change the password itself.","page":"/attacks/ssh-key-backdoor","sessions":270,"addresses":181,"daily":[{"day":"2026-10-14","n":45,"partial":true},{"day":"2026-10-15","n":76,"partial":false},{"day":"2026-10-16","n":17,"partial":false},{"day":"2026-10-17","n":13,"partial":false},{"day":"2026-10-18","n":13,"partial":false},{"day":"2026-10-19","n":85,"partial":false},{"day":"2026-10-20","n":21,"partial":false},{"day":"2026-10-21","n":0,"partial":true}]},{"slug":"download-run","name":"Download and run","summary":"Tries to download a program and run it, in one line.","page":"/attacks#download-run","sessions":10,"addresses":5,"daily":[{"day":"2026-10-14","n":1,"partial":true},{"day":"2026-10-15","n":2,"partial":false},{"day":"2026-10-16","n":0,"partial":false},{"day":"2026-10-17","n":1,"partial":false},{"day":"2026-10-18","n":3,"partial":false},{"day":"2026-10-19","n":3,"partial":false},{"day":"2026-10-20","n":0,"partial":false},{"day":"2026-10-21","n":0,"partial":true}]},{"slug":"fingerprint","name":"System survey","summary":"Reads what the machine is (processor, system, uptime) and leaves.","page":"/attacks#fingerprint","sessions":86,"addresses":50,"daily":[{"day":"2026-10-14","n":10,"partial":true},{"day":"2026-10-15","n":15,"partial":false},{"day":"2026-10-16","n":15,"partial":false},{"day":"2026-10-17","n":4,"partial":false},{"day":"2026-10-18","n":20,"partial":false},{"day":"2026-10-19","n":7,"partial":false},{"day":"2026-10-20","n":12,"partial":false},{"day":"2026-10-21","n":3,"partial":true}]},{"slug":"shell-check","name":"Shell check","summary":"Types the words that open a shell on a router, then goes quiet. Some go on to the busybox test Mirai's scanner runs before it reports a working password.","page":"/attacks#shell-check","sessions":400,"addresses":46,"daily":[{"day":"2026-10-14","n":116,"partial":true},{"day":"2026-10-15","n":74,"partial":false},{"day":"2026-10-16","n":54,"partial":false},{"day":"2026-10-17","n":42,"partial":false},{"day":"2026-10-18","n":48,"partial":false},{"day":"2026-10-19","n":55,"partial":false},{"day":"2026-10-20","n":10,"partial":false},{"day":"2026-10-21","n":1,"partial":true}]},{"slug":"oddities","name":"Oddities","summary":"Fits none of the above: web and phone-system scanners knocking on the telnet port, pasted scripts, a bot stuck in a loop.","page":"/attacks#oddities","sessions":49,"addresses":18,"daily":[{"day":"2026-10-14","n":2,"partial":true},{"day":"2026-10-15","n":11,"partial":false},{"day":"2026-10-16","n":3,"partial":false},{"day":"2026-10-17","n":20,"partial":false},{"day":"2026-10-18","n":0,"partial":false},{"day":"2026-10-19","n":12,"partial":false},{"day":"2026-10-20","n":1,"partial":false},{"day":"2026-10-21","n":0,"partial":true}]}]}