Home/Threat intelligence/Threat trends

Threat trends

Aggregate public scanning, authentication brute force and web attack observations by UTC date while preserving category overlap.

Observation window
Public threat activity observed

Total events are unique event records. Category signals may overlap and are never added into an inflated total.

Unique events2Deduplicated total
Public sources2Unique source IPs
24-hour events0Current activity
Observing sensors1Observation coverage
Last observed8/28/2026, 14:27:17UTC evidence time

Attack-type comparison

Category counts explain behavior composition. One event may match both scanning and web probing.

Daily category trends

Shows up to the latest 30 days in the selected window. The three bars are scanning, brute force and web activity; zeroes are not drawn.

Scanning / probingAuthentication brute forceWeb attacks / probing
There are no public events to plot in this window.

Public source trend ranking

Unique events are deduplicated records; the three category columns are overlapping signals. Open an IP for complete threat evidence.

2 sources
Source IPUnique eventsScanningBrute forceWebSensorsLast observed
129.211.162.23110118/28/2026, 14:27:17
20.118.250.50110118/28/2026, 14:24:35
Trend measurement modelUnique events are real event records. Category signals are evaluated independently, so their counts must not be added as the total. Not observed never means safe.Public trends retain only source IP, category counts, sensor count and time. Usernames, request content, payloads and sensor identifiers are never exposed.ClickHouse analytics · Aggregated 10/15/2026, 06:01:52