April 30, 2026 | Ben Gilbert | Texas City
PACKET_SCYTHE
20 PCAPs • 4533 sessions • 2377 hosts • 2377 🌍 geolocated
▶ 📄 DevOpswithGrok_20260430_1112amCST.pcap 2.4 MB • 760 sessions • TCP:749 UDP:6 ICMP:5
▶ 📄 capture_20260427200001.pcap 3.8 KB • 10 sessions • ICMP:7 UDP:2 TCP:1
▶ 📄 capture_20260427210001.pcap 2.3 KB • 5 sessions • ICMP:3 UDP:2
▶ 📄 capture_20260427220001.pcap 21.0 KB • 23 sessions • UDP:4 TCP:10 ICMP:9
▶ 📄 capture_20260427230001.pcap 18.8 KB • 18 sessions • ICMP:11 UDP:2 TCP:5
▶ 📄 capture_20260428000001.pcap 23.9 KB • 85 sessions • ICMP:16 TCP:67 UDP:2
▶ 📄 capture_20260428010001.pcap 256.9 KB • 85 sessions • TCP:81 UDP:4
▶ 📄 capture_20260428020001.pcap 3.6 KB • 11 sessions • UDP:2 ICMP:9
▶ 📄 capture_20260430050001.pcap 119.3 KB • 318 sessions • TCP:316 UDP:2
▶ 📄 capture_20260430060001.pcap 1.3 MB • 337 sessions • TCP:326 UDP:4 ICMP:7
▶ 📄 capture_20260430070001.pcap 143.1 KB • 374 sessions • UDP:4 TCP:339 ICMP:31
▶ 📄 capture_20260430080001.pcap 222.0 KB • 408 sessions • TCP:371 ICMP:34 UDP:3
▶ 📄 capture_20260430090001.pcap 129.9 KB • 350 sessions • TCP:347 UDP:2 ICMP:1
▶ 📄 capture_20260430100001.pcap 130.6 KB • 359 sessions • TCP:356 UDP:2 ICMP:1
▶ 📄 capture_20260430110001.pcap 121.8 KB • 325 sessions • TCP:323 UDP:2
▶ 📄 capture_20260430120001.pcap 1.6 KB • 4 sessions • UDP:2 ICMP:1 TCP:1
▶ 📄 capture_20260430130001.pcap 1.7 KB • 4 sessions • UDP:2 ICMP:1 TCP:1
▶ 📄 capture_20260430140001.pcap 121.3 KB • 332 sessions • TCP:329 ICMP:1 UDP:2
▶ 📄 capture_20260430150001.pcap 133.1 KB • 359 sessions • TCP:357 UDP:2
▶ 📄 capture_20260430160001.pcap 871.8 KB • 366 sessions • TCP:361 UDP:4 ICMP:1
SCYTHE_ROUTE
[21:37:22] FTP Ingest (172.234.197.23): Ingested 5 PCAPs → 222 sessions, 1095 nodes, 2764 edges
[21:37:28] [FTP Ingest] Created 185 Recon Entities from PCAP hosts
[21:37:28] [FTP Ingest] Camera tracking primary host: 2.57.122.196
[21:37:28] [Post-Ingest] Evidence gate opened. Starting re-materialization pipeline...
[21:37:29] Loaded 7 FTP PCAPs with 237 total sessions
[21:37:35] [FTP Load] Created 193 Recon Entities from PCAP hosts
[21:37:35] [FTP Load] Camera tracking primary host: 2.57.122.196
[21:37:35] DPI Enrichment: 2 DNS names
[21:37:35] [Post-Ingest] Session list reloaded from graph
[21:37:36] [Post-Ingest] BSG auto-detected: 3 behavioral groups
[21:37:37] [Post-Ingest] GraphOps memory re-synchronized
[21:37:37] [Post-Ingest] Re-materialization pipeline complete
21:37:51] Loading Auto-Recon entities...
[21:37:58] Loaded 201 reconnaissance entities
[21:37:59] ⚠️ 1 proximity alerts active!
[21:54:10] Traceroute → 51.224.144.61
[21:54:18] 18 hops
[21:54:18] Hop 1: 📡XCI55AX.mynetworksettings.com — 1.47ms [rf_link] ⊘dist
[21:54:18] Hop 2: 🔄10.184.141.2 — 243.79ms [mimo_reassembly] ⚡ MIMO ⊘dist
[21:54:18] Hop 3: ⚙️10.184.141.2 — 54.85ms [packet_core] ⚠ priv ⊘dist
[21:54:18] Hop 4: ⚙️10.184.141.1 — 54.85ms [packet_core] ⚠ priv ⊘dist
[21:54:18] Hop 5: 🔀234.qarestr.sub-172-19-2.myvzw.com — 54.85ms [cgnat_cluster] ⚠ spike ⊘dist
[21:54:18] Hop 6: 🏗️185.sub-69-83-101.myvzw.com — 54.85ms [mpls_private_backbone] ⚠ spike ⊘dist
[21:54:18] Hop 7: 🏗️187.sub-69-83-101.myvzw.com — 30.84ms [mpls_private_backbone] ⚠ spike ⊘dist
[21:54:18] Hop 9: 🏗️212.sub-69-83-96.myvzw.com — 33.97ms [mpls_private_backbone] ⚠ spike ⊘dist
[21:54:18] Hop 10: 🏗️75.sub-69-83-97.myvzw.com — 31.7ms [mpls_private_backbone] ⚠ spike ⊘dist
[21:54:18] Hop 13: 🔌dls-bb1-link.ip.twelve99.net — 26.86ms +1678.8km [access_router] ⚠ spike
[21:54:18] Hop 14: 🔌nash-bb1-link.ip.twelve99.net — 43.98ms +2748.8km [access_router] ⚠ spike
[21:54:18] Hop 15: 🔌atl-bb1-link.ip.twelve99.net — 51.8ms +3237.5km [access_router] ⚠ spike
[21:54:18] Hop 16: 🔌rest-bb1-link.ip.twelve99.net — 66.84ms +4177.5km [access_router] ⚠ spike
[21:54:18] Hop 17: 🔌ash-b2-link.ip.twelve99.net — 154.36ms +9647.5km [access_router] ⚠ spike
[21:54:18] Hop 18: 🔌ash-bb2-link.ip.twelve99.net — 68.5ms +4281.2km [access_router] ⚠ spike
[21:54:18] Hop 19: 🔌prs-bb2-link.ip.twelve99.net — 151.83ms +9489.4km [access_router] ⚠ spike
[21:54:18] Hop 20: 🔌prs-b3-link.ip.twelve99.net — 152.55ms +9534.4km [access_router] ⚠ spike
[21:54:18] Hop 30: 🎯ec2-51-224-144-61.eusc-de-east-1.compute.amazonaws.eu — 183.37ms +11460.6km [destination] ⚠ spike
[21:54:18] 🔴 5G MIMO path detected — early hops excluded from distance
[21:54:18] 📏 Distance hops: 9 of 18 usable
[21:54:18] Total: ~9168.5 km from server
[21:54:18] 🌐 3 trace entities on globe (6 logical segments)
[22:01:06] Starting scan on 51.224.144.61...
[22:01:06] Initiating enhanced nmap scan on 51.224.144.61...
[22:01:06] Command: nmap --traceroute 51.224.144.61
[22:01:06] Sending request to /api/nmap/scan...
[22:03:06] Backend scan completed successfully
[22:03:13] Traceroute: 18 hops (1 clean, 17 anomalous)
[22:03:13] Hop 1: XCI55AX.mynetworksettings.com — 1.3ms +65km
[22:03:13] Hop 2: 10.184.141.2 — 46.03ms ⚠ private_backbone
[22:03:13] Hop 3: 10.184.141.2 — 46.01ms ⚠ private_backbone
[22:03:13] Hop 4: 10.184.141.1 — 44.06ms ⚠ private_backbone
[22:03:13] Hop 5: 234.qarestr.sub-172-19-2.myvzw.com — 44.18ms ⚠ rtt_spike
[22:03:13] Hop 7: 187.sub-69-83-101.myvzw.com — 43.15ms ⚠ rtt_spike
[22:03:13] Hop 8: 177.sub-69-83-101.myvzw.com — 44.28ms ⚠ rtt_spike
[22:03:13] Hop 9: 212.sub-69-83-96.myvzw.com — 38.2ms ⚠ rtt_spike
[22:03:13] Hop 10: 75.sub-69-83-97.myvzw.com — 36.37ms ⚠ rtt_spike
[22:03:13] Hop 13: dls-bb1-link.ip.twelve99.net — 25.93ms ⚠ rtt_spike
[22:03:13] Hop 14: nash-bb1-link.ip.twelve99.net — 51.5ms ⚠ rtt_spike
[22:03:13] Hop 15: atl-bb1-link.ip.twelve99.net — 49.69ms ⚠ rtt_spike
[22:03:13] Hop 16: rest-bb1-link.ip.twelve99.net — 64.66ms ⚠ rtt_spike
[22:03:13] Hop 17: ash-b2-link.ip.twelve99.net — 151.64ms ⚠ rtt_spike
[22:03:13] Hop 18: ash-bb2-link.ip.twelve99.net — 70.38ms ⚠ rtt_spike
[22:03:13] Hop 19: prs-bb2-link.ip.twelve99.net — 159.66ms ⚠ rtt_spike
[22:03:13] Hop 20: prs-b3-link.ip.twelve99.net — 151.56ms ⚠ rtt_spike
[22:03:13] Hop 30: ec2-51-224-144-61.eusc-de-east-1.compute.amazonaws.eu — 172.95ms ⚠ rtt_spike
[22:03:13] 📏 Path distance: ~8647.5 km (min-RTT estimate, anomalous hops excluded)
[22:03:17] 🎯 Ping: min 166ms → ~5187.5 km (4657.4–5717.6 km) conf 94%
🧠 CLUSTER_SCYTHE INTEL
Clusters: 58
Threats: 4
RF emitters: 0
UAVs: 0
C2: 0
⚫ Quiet
HIGH 60%
Cluster: swarm-c108ff10
Nodes: 9
Behavior: MIXED
ASN: AS138915 — Kaopu Cloud HK Limited
Country: SG
Mobility: Fixed infrastructure
Location: 1.294°, 103.846° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS138915 — Kaopu Cloud HK Limited (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS138915 (Kaopu Cloud HK Limited) ⚠ mixed infra (4 ASNs, 25% confidence) · Jurisdiction: SG
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
→ [MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster — mixed infrastructure indicates distributed operation
⚫ Quiet
HIGH 60%
Cluster: swarm-5c2e3a0a
Nodes: 13
Behavior: MIXED
ASN: AS71 — Amazon.com, Inc.
Infra: Hyperscaler (40% conf) · 4 ASNs
Country: GB
Mobility: Fixed infrastructure
Location: 51.510°, -0.108° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS71 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS71 (Amazon.com, Inc.) [Hyperscaler] ⚠ mixed infra (4 ASNs, 40% confidence) · Jurisdiction: GB
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
HIGH 60%
Cluster: swarm-8565ce42
Nodes: 228
Behavior: MIXED
ASN: AS203771 — Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi
Country: TR
Mobility: Fixed infrastructure
Location: 41.012°, 28.980° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS203771 — Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS203771 (Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi) ⚠ mixed infra (4 ASNs, 34% confidence) · Jurisdiction: TR
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
→ [MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster — mixed infrastructure indicates distributed operation
⚫ Quiet
HIGH 60%
Cluster: swarm-ded8abbd
Nodes: 10
Behavior: MIXED
ASN: AS48090 — Techoff Srv Limited
Country: NL
Mobility: Fixed infrastructure
Location: 52.379°, 4.899° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS48090 — Techoff Srv Limited (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS48090 (Techoff Srv Limited) ⚠ mixed infra (4 ASNs, 25% confidence) · Jurisdiction: NL
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
→ [MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster — mixed infrastructure indicates distributed operation
⚫ Quiet
MEDIUM 50%
Cluster: swarm-b8afacf0
Nodes: 18
Behavior: MIXED
ASN: AS16276 — OVH SAS
Infra: VPS Provider (63% conf) · 3 ASNs
Country: FR
Mobility: Fixed infrastructure
Location: 48.858°, 2.340° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16276 — OVH SAS (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16276 (OVH SAS) [VPS Provider] · Jurisdiction: FR
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-eea8f7a5
Nodes: 10
Behavior: MIXED
ASN: AS31377 — Akamai Connected Cloud
Infra: Edge CDN (75% conf) · 2 ASNs
Country: US
Mobility: Fixed infrastructure
Location: 41.873°, -87.630° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS31377 — Akamai Connected Cloud (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS31377 (Akamai Connected Cloud) [Edge CDN] · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-1417b7c6
Nodes: 10
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (50% conf) · 3 ASNs
Country: JP
Mobility: Fixed infrastructure
Location: 35.690°, 139.690° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: JP
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-501bd393
Nodes: 13
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (67% conf) · 2 ASNs
Country: SE
Mobility: Fixed infrastructure
Location: 59.329°, 18.072° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: SE
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-68bcb848
Nodes: 7
Behavior: MIXED
ASN: AS32392 — Amazon.com, Inc.
Infra: Hyperscaler (33% conf) · 3 ASNs
Country: IN
Mobility: Fixed infrastructure
Location: 17.384°, 78.458° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS32392 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS32392 (Amazon.com, Inc.) [Hyperscaler] ⚠ mixed infra (3 ASNs, 33% confidence) · Jurisdiction: IN
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-77c1dfab
Nodes: 9
Behavior: MIXED
ASN: AS23470 — ReliableSite.Net LLC
Country: US
Mobility: Fixed infrastructure
Location: 40.623°, -74.215° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS23470 — ReliableSite.Net LLC (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS23470 (ReliableSite.Net LLC) ⚠ mixed infra (3 ASNs, 33% confidence) · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-6b834a9d
Nodes: 7
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (67% conf) · 2 ASNs
Country: ES
Mobility: Fixed infrastructure
Location: 41.658°, -0.878° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: ES
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-1b36b68b
Nodes: 11
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (100% conf)
Country: NZ
Mobility: Fixed infrastructure
Location: -36.850°, 174.768° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: NZ
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-29cc34ed
Nodes: 14
Behavior: MIXED
ASN: AS13335 — Cloudflare, Inc.
Infra: Edge CDN (83% conf) · 2 ASNs
Country: US
Mobility: Fixed infrastructure
Location: 29.766°, -95.394° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS13335 — Cloudflare, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS13335 (Cloudflare, Inc.) [Edge CDN] · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-c5c41b3b
Nodes: 3
Behavior: MIXED
ASN: AS10396 — DATACOM CARIBE, INC.
Country: PR
Mobility: Fixed infrastructure
Location: 18.404°, -66.149° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS10396 — DATACOM CARIBE, INC. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS10396 (DATACOM CARIBE, INC.) · Jurisdiction: PR
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-08a8b532
Nodes: 3
Behavior: MIXED
ASN: AS42821 — Feo Prest SRL
Country: TW
Mobility: Fixed infrastructure
Location: 24.000°, 121.000° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS42821 — Feo Prest SRL (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS42821 (Feo Prest SRL) · Jurisdiction: TW
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-7b3479de
Nodes: 5
Behavior: MIXED
ASN: AS8897 — Valence Technology Co.
Country: US
Mobility: Fixed infrastructure
Location: 37.751°, -97.822° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS8897 — Valence Technology Co. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS8897 (Valence Technology Co.) · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-0c174242
Nodes: 19
Behavior: MIXED
ASN: AS47890 — Unmanaged Ltd
Country: RO
Mobility: Fixed infrastructure
Location: 45.997°, 24.997° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS47890 — Unmanaged Ltd (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS47890 (Unmanaged Ltd) · Jurisdiction: RO
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-3c8596bd
Nodes: 7
Behavior: MIXED
ASN: AS8612 — Amazon.com, Inc.
Infra: Hyperscaler (100% conf)
Country: MX
Mobility: Fixed infrastructure
Location: 20.588°, -100.388° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS8612 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS8612 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: MX
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-418188e5
Nodes: 7
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (100% conf)
Country: CA
Mobility: Fixed infrastructure
Location: 51.050°, -114.088° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: CA
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-390f6cef
Nodes: 17
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (100% conf)
Country: DE
Mobility: Fixed infrastructure
Location: 52.520°, 13.407° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: DE
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-b7929cca
Nodes: 9
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (75% conf) · 2 ASNs
Country: JP
Mobility: Fixed infrastructure
Location: 34.693°, 135.500° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: JP
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-c9adcd15
Nodes: 43
Behavior: MIXED
ASN: AS203771 — Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi
Country: IN
Mobility: Fixed infrastructure
Location: 19.075°, 72.886° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS203771 — Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS203771 (Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi) · Jurisdiction: IN
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-81dd6f38
Nodes: 1282
Behavior: MIXED
ASN: AS271410 — Smart Servico de Internet Ltda
Country: BR
Mobility: Fixed infrastructure
Location: -23.629°, -46.635° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS271410 — Smart Servico de Internet Ltda (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS271410 (Smart Servico de Internet Ltda) · Jurisdiction: BR
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-27e4ee46
Nodes: 6
Behavior: MIXED
ASN: AS31549 — Dade Samane Fanava Company (PJS)
Country: IR
Mobility: Fixed infrastructure
Location: 35.690°, 51.414° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS31549 — Dade Samane Fanava Company (PJS) (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS31549 (Dade Samane Fanava Company (PJS)) · Jurisdiction: IR
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-0e82d452
Nodes: 13
Behavior: MIXED
ASN: AS55960 — Beijing Guanghuan Xinwang Digital
Country: CN
Mobility: Fixed infrastructure
Location: 39.911°, 116.395° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS55960 — Beijing Guanghuan Xinwang Digital (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS55960 (Beijing Guanghuan Xinwang Digital) · Jurisdiction: CN
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-8ee7be51
Nodes: 21
Behavior: MIXED
ASN: AS24940 — Hetzner Online GmbH
Infra: VPS Provider (60% conf) · 5 ASNs
Country: DE
Mobility: Fixed infrastructure
Location: 50.478°, 12.365° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS24940 — Hetzner Online GmbH (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS24940 (Hetzner Online GmbH) [VPS Provider] · Jurisdiction: DE
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-60b1c65e
Nodes: 5
Behavior: MIXED
ASN: AS13414 — Twitter Inc.
Country: US
Mobility: Fixed infrastructure
Location: 33.770°, -84.375° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS13414 — Twitter Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS13414 (Twitter Inc.) · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-4a5bc8af
Nodes: 6
Behavior: MIXED
ASN: AS7018 — AT&T Enterprises, LLC
Infra: ISP (50% conf) · 2 ASNs
Country: US
Mobility: Fixed infrastructure
Location: 37.316°, -121.896° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS7018 — AT&T Enterprises, LLC (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS7018 (AT&T Enterprises, LLC) [ISP] · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-a099f9db
Nodes: 6
Behavior: MIXED
ASN: AS152194 — CTG Server Limited
Country: HK
Mobility: Fixed infrastructure
Location: 22.271°, 114.171° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS152194 — CTG Server Limited (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS152194 (CTG Server Limited) · Jurisdiction: HK
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-e79aaf60
Nodes: 3
Behavior: MIXED
ASN: AS7018 — AT&T Enterprises, LLC
Infra: ISP (100% conf)
Country: US
Mobility: Fixed infrastructure
Location: 41.648°, -88.090° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS7018 — AT&T Enterprises, LLC (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS7018 (AT&T Enterprises, LLC) [ISP] · Jurisdiction: US
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-7baa4a1e
Nodes: 3
Behavior: MIXED
ASN: AS204880 — Stowarzyszenie Warszawski Hackerspace
Infra: Hyperscaler (100% conf)
Country: PL
Mobility: Fixed infrastructure
Location: 52.239°, 21.036° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS204880 — Stowarzyszenie Warszawski Hackerspace (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS204880 (Stowarzyszenie Warszawski Hackerspace) [Hyperscaler] · Jurisdiction: PL
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-8501a8cc
Nodes: 3
Behavior: MIXED
ASN: AS16276 — OVH SAS
Infra: VPS Provider (100% conf)
Country: CA
Mobility: Fixed infrastructure
Location: 43.632°, -79.372° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16276 — OVH SAS (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16276 (OVH SAS) [VPS Provider] · Jurisdiction: CA
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-f3cc76ff
Nodes: 3
Behavior: MIXED
ASN: AS16276 — OVH SAS
Infra: VPS Provider (100% conf)
Country: CA
Mobility: Fixed infrastructure
Location: 45.506°, -73.579° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16276 — OVH SAS (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16276 (OVH SAS) [VPS Provider] · Jurisdiction: CA
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-d60281c0
Nodes: 3
Behavior: MIXED
ASN: AS16276 — OVH SAS
Infra: VPS Provider (100% conf)
Country: US
Mobility: Fixed infrastructure
Location: 38.881°, -77.301° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16276 — OVH SAS (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16276 (OVH SAS) [VPS Provider] · Jurisdiction: US
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-77aadc77
Nodes: 6
Behavior: MIXED
ASN: AS5430 — netcup GmbH
Country: DE
Mobility: Fixed infrastructure
Location: 49.447°, 11.049° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS5430 — netcup GmbH (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS5430 (netcup GmbH) · Jurisdiction: DE
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-5b806398
Nodes: 3
Behavior: MIXED
ASN: AS40788 — Start Communications
Country: CA
Mobility: Fixed infrastructure
Location: 42.987°, -81.181° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS40788 — Start Communications (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS40788 (Start Communications) · Jurisdiction: CA
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-e71b4778
Nodes: 5
Behavior: MIXED
ASN: AS214139 — Private.coffee- Verein zur Forderung von Privatsphare und digitaler Souveranitat
Country: BE
Mobility: Fixed infrastructure
Location: 50.852°, 4.346° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS214139 — Private.coffee- Verein zur Forderung von Privatsphare und digitaler Souveranitat (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS214139 (Private.coffee- Verein zur Forderung von Privatsphare und digitaler Souveranitat) · Jurisdiction: BE
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-5ea2d20a
Nodes: 3
Behavior: MIXED
ASN: AS19529 — The Constant Company, LLC
Country: AU
Mobility: Fixed infrastructure
Location: -37.816°, 144.967° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS19529 — The Constant Company, LLC (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS19529 (The Constant Company, LLC) · Jurisdiction: AU
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-61e1337e
Nodes: 9
Behavior: MIXED
ASN: AS14618 — Amazon.com, Inc.
Infra: Hyperscaler (75% conf) · 2 ASNs
Country: US
Mobility: Fixed infrastructure
Location: 39.047°, -77.490° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS14618 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS14618 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-9ad4c5e5
Nodes: 3
Behavior: MIXED
ASN: AS12392 — VOO S.A.
Country: BE
Mobility: Fixed infrastructure
Location: 50.698°, 5.598° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS12392 — VOO S.A. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS12392 (VOO S.A.) · Jurisdiction: BE
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-1356e469
Nodes: 3
Behavior: MIXED
ASN: AS3356 — Alibaba US Technology Co., Ltd.
Infra: Backbone (100% conf)
Country: TH
Mobility: Fixed infrastructure
Location: 13.750°, 100.517° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS3356 — Alibaba US Technology Co., Ltd. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS3356 (Alibaba US Technology Co., Ltd.) [Backbone] · Jurisdiction: TH
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-83c3de80
Nodes: 5
Behavior: MIXED
ASN: AS8649 — Hetzner Online GmbH
Infra: VPS Provider (50% conf) · 2 ASNs
Country: FI
Mobility: Fixed infrastructure
Location: 60.172°, 24.935° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS8649 — Hetzner Online GmbH (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS8649 (Hetzner Online GmbH) [VPS Provider] · Jurisdiction: FI
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-722725ba
Nodes: 3
Behavior: MIXED
ASN: AS7018 — AT&T Enterprises, LLC
Infra: ISP (100% conf)
Country: US
Mobility: Fixed infrastructure
Location: 27.318°, -80.352° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS7018 — AT&T Enterprises, LLC (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS7018 (AT&T Enterprises, LLC) [ISP] · Jurisdiction: US
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-64a340ae
Nodes: 2472
Behavior: MIXED
ASN: AS262880 — RADAR WISP LTDA
Country: BR
Mobility: Fixed infrastructure
Location: -16.289°, -49.016° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS262880 — RADAR WISP LTDA (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS262880 (RADAR WISP LTDA) · Jurisdiction: BR
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-7e194104
Nodes: 3
Behavior: MIXED
ASN: AS4766 — Korea Telecom
Infra: ISP (100% conf)
Country: KR
Mobility: Fixed infrastructure
Location: 36.114°, 128.343° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS4766 — Korea Telecom (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS4766 (Korea Telecom) [ISP] · Jurisdiction: KR
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-48744087
Nodes: 3
Behavior: MIXED
ASN: AS15169 — Google LLC
Infra: Hyperscaler (100% conf)
Country: CH
Mobility: Fixed infrastructure
Location: 47.364°, 8.544° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS15169 — Google LLC (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS15169 (Google LLC) [Hyperscaler] · Jurisdiction: CH
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-ba7f8443
Nodes: 49
Behavior: MIXED
ASN: AS16509 — Amazon.com, Inc.
Infra: Hyperscaler (50% conf) · 4 ASNs
Country: US
Mobility: Fixed infrastructure
Location: 45.840°, -119.705° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16509 — Amazon.com, Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-7705fff2
Nodes: 6
Behavior: MIXED
ASN: AS216030 — GoodLeaf Hosting & Development LLC
Country: US
Mobility: Fixed infrastructure
Location: 32.863°, -96.752° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS216030 — GoodLeaf Hosting & Development LLC (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS216030 (GoodLeaf Hosting & Development LLC) · Jurisdiction: US
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-622edeb8
Nodes: 5
Behavior: MIXED
ASN: AS4812 — China Telecom Group
Infra: ISP (100% conf)
Country: CN
Mobility: Fixed infrastructure
Location: 31.222°, 121.458° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS4812 — China Telecom Group (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS4812 (China Telecom Group) [ISP] · Jurisdiction: CN
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-cf233f95
Nodes: 3
Behavior: MIXED
ASN: AS4837 — CHINA UNICOM China169 Backbone
Country: CN
Mobility: Fixed infrastructure
Location: 34.773°, 113.722° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS4837 — CHINA UNICOM China169 Backbone (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS4837 (CHINA UNICOM China169 Backbone) · Jurisdiction: CN
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-744c4fe9
Nodes: 3
Behavior: MIXED
ASN: AS22394 — Verizon Business
Infra: ISP (100% conf)
Country: US
Mobility: Fixed infrastructure
Location: 38.958°, -85.888° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS22394 — Verizon Business (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS22394 (Verizon Business) [ISP] · Jurisdiction: US
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-63954e9e
Nodes: 3
Behavior: MIXED
ASN: AS16637 — Edgenext Legend Dynasty Pte. Ltd.
Country: SC
Mobility: Fixed infrastructure
Location: -4.583°, 55.667° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS16637 — Edgenext Legend Dynasty Pte. Ltd. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS16637 (Edgenext Legend Dynasty Pte. Ltd.) · Jurisdiction: SC
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-18a070b6
Nodes: 5
Behavior: MIXED
ASN: AS7018 — China Mobile Communications Group Co., Ltd.
Infra: ISP (50% conf) · 2 ASNs
Country: CN
Mobility: Fixed infrastructure
Location: 37.253°, 105.998° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS7018 — China Mobile Communications Group Co., Ltd. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS7018 (China Mobile Communications Group Co., Ltd.) [ISP] · Jurisdiction: CN
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
⚫ Quiet
MEDIUM 50%
Cluster: swarm-2f7574bb
Nodes: 3
Behavior: MIXED
ASN: AS8849 — Melbikomas UAB
Country: NG
Mobility: Fixed infrastructure
Location: 6.447°, 3.390° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS8849 — Melbikomas UAB (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS8849 (Melbikomas UAB) · Jurisdiction: NG
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-cc7ec209
Nodes: 3
Behavior: MIXED
ASN: AS9198 — JSC Kazakhtelecom
Infra: ISP (100% conf)
Country: KZ
Mobility: Fixed infrastructure
Location: 51.188°, 71.449° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS9198 — JSC Kazakhtelecom (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS9198 (JSC Kazakhtelecom) [ISP] · Jurisdiction: KZ
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-93eff2b3
Nodes: 3
Behavior: MIXED
ASN: AS206406 — C BEYOND s.a.l
Country: LB
Mobility: Fixed infrastructure
Location: 33.892°, 35.502° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS206406 — C BEYOND s.a.l (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS206406 (C BEYOND s.a.l) · Jurisdiction: LB
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-5011d4bd
Nodes: 3
Behavior: MIXED
ASN: AS31291 — ColocaTel Inc.
Country: BG
Mobility: Fixed infrastructure
Location: 42.683°, 23.322° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS31291 — ColocaTel Inc. (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS31291 (ColocaTel Inc.) · Jurisdiction: BG
→ Awaiting sufficient data
⚫ Quiet
MEDIUM 50%
Cluster: swarm-1e66275c
Nodes: 332
Behavior: MIXED
ASN: AS273470 — WORK TELECOM INTERNET LTDA
Infra: ISP (100% conf)
Country: BR
Mobility: Fixed infrastructure
Location: -21.100°, -41.692° 🌍 Fly To 🔬 AUTOPSY📦 BUNDLE
⏱ Phase: 0%
Prop: INSUFFICIENT_DATA
⚡ Control Origin: AS273470 — WORK TELECOM INTERNET LTDA (0% · cluster-level ASN (no per-event data))
Insufficient activity for classification · Dominant: AS273470 (WORK TELECOM INTERNET LTDA) [ISP] · Jurisdiction: BR
→ [LOW] SCHEDULE_RESCAN: Large dormant cluster — may be staging infrastructure
[14:52:27]⚫Quiet — 332 nodes @ -21.10°,-41.69° BR · AS273470 (WORK TELECOM INTERNET LTDA) [ISP] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 42.68°,23.32° BG · AS31291 (ColocaTel Inc.) · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 33.89°,35.50° LB · AS206406 (C BEYOND s.a.l) · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 51.19°,71.45° KZ · AS9198 (JSC Kazakhtelecom) [ISP] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 6.45°,3.39° NG · AS8849 (Melbikomas UAB) · threat 50%
[14:52:27]⚫Quiet — 5 nodes @ 37.25°,106.00° CN · AS7018 (China Mobile Communications Group Co., Ltd.) [ISP] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ -4.58°,55.67° SC · AS16637 (Edgenext Legend Dynasty Pte. Ltd.) · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 38.96°,-85.89° US · AS22394 (Verizon Business) [ISP] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 34.77°,113.72° CN · AS4837 (CHINA UNICOM China169 Backbone) · threat 50%
[14:52:27]⚫Quiet — 5 nodes @ 31.22°,121.46° CN · AS4812 (China Telecom Group) [ISP] · threat 50%
[14:52:27]⚫Quiet — 6 nodes @ 32.86°,-96.75° US · AS216030 (GoodLeaf Hosting & Development LLC) · threat 50%
[14:52:27]⚫Quiet — 49 nodes @ 45.84°,-119.70° US · AS16509 (Amazon.com, Inc.) [Hyperscaler] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 47.36°,8.54° CH · AS15169 (Google LLC) [Hyperscaler] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 36.11°,128.34° KR · AS4766 (Korea Telecom) [ISP] · threat 50%
[14:52:27]⚫Quiet — 2472 nodes @ -16.29°,-49.02° BR · AS262880 (RADAR WISP LTDA) · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 27.32°,-80.35° US · AS7018 (AT&T Enterprises, LLC) [ISP] · threat 50%
[14:52:27]⚫Quiet — 5 nodes @ 60.17°,24.93° FI · AS8649 (Hetzner Online GmbH) [VPS Provider] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 13.75°,100.52° TH · AS3356 (Alibaba US Technology Co., Ltd.) [Backbone] · threat 50%
[14:52:27]⚫Quiet — 3 nodes @ 50.70°,5.60° BE · AS12392 (VOO S.A.) · threat 50%
[14:52:27]⚫Quiet — 9 nodes @ 39.05°,-77.49° US · AS14618 (Amazon.com, Inc.) [Hyperscaler] · threat 50%
🌐 INFRA_SCYTHE FLOW
Paths: 191
Physical: 191
Synthetic: 0
Cables: 10
IX: 7
Conflicts: 0
CSI: 0
Cascades: 0
👻 Phantoms: 0
Kill Chain: 0
✓ PHYSICAL🔗 CABLE⚡ IX AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
🔗 Pacific Crossing-1
⚡ JPNAP Tokyo
9712 km
⚡ IX AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
⚡ AMS-IX Amsterdam, DE-CIX Frankfurt
1544 km
✓ PHYSICAL🔗 CABLE AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
🔗 MAREA, SEA-ME-WE 6, Pacific Crossing-1, Grace Hopper, Dunant, PEACE
839 km
AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
18546 km
AS16276 → AS133353 hops · 0%
AS16276 → AS3356 → AS13335
8086 km
✓ PHYSICAL🔗 CABLE AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
🔗 Pacific Crossing-1
7375 km
✓ PHYSICAL🔗 CABLE⚡ IX AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
🔗 Grace Hopper
⚡ DE-CIX Frankfurt, AMS-IX Amsterdam
878 km
✓ PHYSICAL🔗 CABLE AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
🔗 Pacific Crossing-1
9634 km
✓ PHYSICAL🔗 CABLE⚡ IX AS16276 → AS249403 hops · 0%
AS16276 → AS3356 → AS24940
🔗 Grace Hopper
⚡ DE-CIX Frankfurt, AMS-IX Amsterdam
743 km
⚡ IX AS16276 → AS70183 hops · 0%
AS16276 → AS3356 → AS7018
⚡ Equinix SV (Palo Alto)
8970 km
✓ PHYSICAL🔗 CABLE⚡ IX AS16276 → AS70183 hops · 0%
AS16276 → AS3356 → AS7018
🔗 Pacific Crossing-1
⚡ Equinix Chicago
6695 km
✓ PHYSICAL🔗 CABLE⚡ IX AS16276 → AS146183 hops · 0%
AS16276 → AS3356 → AS14618
🔗 MAREA, FLAG Atlantic-1, Pacific Crossing-1, Grace Hopper, Dunant
⚡ Equinix Ashburn
6185 km
AS16276 → AS33562 hops · 0%
AS16276 → AS3356
9446 km
AS16276 → AS70183 hops · 0%
AS16276 → AS3356 → AS7018
7246 km
✓ PHYSICAL🔗 CABLE⚡ IX AS16276 → AS151693 hops · 0%
AS16276 → AS3356 → AS15169
🔗 SEA-ME-WE 6, FLAG Atlantic-1, Pacific Crossing-1, Grace Hopper, PEACE
⚡ DE-CIX Frankfurt, AMS-IX Amsterdam
489 km
✓ PHYSICAL🔗 CABLE AS16276 → AS165093 hops · 0%
AS16276 → AS3356 → AS16509
🔗 Pacific Crossing-1
8086 km
✓ PHYSICAL🔗 CABLE AS16276 → AS48373 hops · 0%
AS16276 → AS3356 → AS4837
🔗 Pacific Crossing-1, PEACE
8513 km
✓ PHYSICAL🔗 CABLE AS16276 → AS70183 hops · 0%
AS16276 → AS3356 → AS7018
🔗 Pacific Crossing-1, PEACE
7850 km
✓ PHYSICAL🔗 CABLE⚡ IX AS16509 → AS133353 hops · 0%
AS16509 → AS3356 → AS13335
🔗 JUPITER
⚡ JPNAP Tokyo
10735 km
⚡ IX AS16509 → AS249403 hops · 0%
AS16509 → AS3356 → AS24940
⚡ JPNAP Tokyo
9134 km
[2:53:48 PM] ✓ 191 paths · 0 synthetic