{"id":5691,"date":"2026-04-28T04:04:44","date_gmt":"2026-04-28T04:04:44","guid":{"rendered":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/?page_id=5691"},"modified":"2026-04-28T04:04:44","modified_gmt":"2026-04-28T04:04:44","slug":"scythe-d06890b0","status":"publish","type":"page","link":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/?page_id=5691","title":{"rendered":"scythe-d06890b0 SESSION-521d3d94be94008e"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">April 30, 2026 | Ben Gilbert | Texas City<\/h2>\n\n\n\n<div class=\"wp-block-file\"><a id=\"wp-block-file--media-b5f4f60e-d638-45da-9b6d-916e4c945a0f\" href=\"https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/04\/session-hypergraph-SESSION-521d3d94.html\">session-hypergraph-SESSION-521d3d94_44MB<\/a><a href=\"https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/04\/session-hypergraph-SESSION-521d3d94.html\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-b5f4f60e-d638-45da-9b6d-916e4c945a0f\">Download<\/a><\/div>\n\n\n\n<pre class=\"wp-block-code\"><code>PACKET_SCYTHE\n20 PCAPs \u2022 4533 sessions \u2022 2377 hosts \u2022 2377 \ud83c\udf0d geolocated\n\u25b6 \ud83d\udcc4 DevOpswithGrok_20260430_1112amCST.pcap 2.4 MB \u2022 760 sessions \u2022 TCP:749 UDP:6 ICMP:5\n\u25b6 \ud83d\udcc4 capture_20260427200001.pcap 3.8 KB \u2022 10 sessions \u2022 ICMP:7 UDP:2 TCP:1\n\u25b6 \ud83d\udcc4 capture_20260427210001.pcap 2.3 KB \u2022 5 sessions \u2022 ICMP:3 UDP:2\n\u25b6 \ud83d\udcc4 capture_20260427220001.pcap 21.0 KB \u2022 23 sessions \u2022 UDP:4 TCP:10 ICMP:9\n\u25b6 \ud83d\udcc4 capture_20260427230001.pcap 18.8 KB \u2022 18 sessions \u2022 ICMP:11 UDP:2 TCP:5\n\u25b6 \ud83d\udcc4 capture_20260428000001.pcap 23.9 KB \u2022 85 sessions \u2022 ICMP:16 TCP:67 UDP:2\n\u25b6 \ud83d\udcc4 capture_20260428010001.pcap 256.9 KB \u2022 85 sessions \u2022 TCP:81 UDP:4\n\u25b6 \ud83d\udcc4 capture_20260428020001.pcap 3.6 KB \u2022 11 sessions \u2022 UDP:2 ICMP:9\n\u25b6 \ud83d\udcc4 capture_20260430050001.pcap 119.3 KB \u2022 318 sessions \u2022 TCP:316 UDP:2\n\u25b6 \ud83d\udcc4 capture_20260430060001.pcap 1.3 MB \u2022 337 sessions \u2022 TCP:326 UDP:4 ICMP:7\n\u25b6 \ud83d\udcc4 capture_20260430070001.pcap 143.1 KB \u2022 374 sessions \u2022 UDP:4 TCP:339 ICMP:31\n\u25b6 \ud83d\udcc4 capture_20260430080001.pcap 222.0 KB \u2022 408 sessions \u2022 TCP:371 ICMP:34 UDP:3\n\u25b6 \ud83d\udcc4 capture_20260430090001.pcap 129.9 KB \u2022 350 sessions \u2022 TCP:347 UDP:2 ICMP:1\n\u25b6 \ud83d\udcc4 capture_20260430100001.pcap 130.6 KB \u2022 359 sessions \u2022 TCP:356 UDP:2 ICMP:1\n\u25b6 \ud83d\udcc4 capture_20260430110001.pcap 121.8 KB \u2022 325 sessions \u2022 TCP:323 UDP:2\n\u25b6 \ud83d\udcc4 capture_20260430120001.pcap 1.6 KB \u2022 4 sessions \u2022 UDP:2 ICMP:1 TCP:1\n\u25b6 \ud83d\udcc4 capture_20260430130001.pcap 1.7 KB \u2022 4 sessions \u2022 UDP:2 ICMP:1 TCP:1\n\u25b6 \ud83d\udcc4 capture_20260430140001.pcap 121.3 KB \u2022 332 sessions \u2022 TCP:329 ICMP:1 UDP:2\n\u25b6 \ud83d\udcc4 capture_20260430150001.pcap 133.1 KB \u2022 359 sessions \u2022 TCP:357 UDP:2\n\u25b6 \ud83d\udcc4 capture_20260430160001.pcap 871.8 KB \u2022 366 sessions \u2022 TCP:361 UDP:4 ICMP:1<\/code><\/pre>\n\n\n\n<div class=\"wp-block-file\"><a id=\"wp-block-file--media-bef5346b-f292-4aa5-adab-9dc0507e96b2\" href=\"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/wp-content\/uploads\/2026\/04\/scythe-d06890b0_04202026_Edges_qty_54755.txt\">scythe-d06890b0_04202026_Edges_qty_54755_7MB<\/a><a href=\"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/wp-content\/uploads\/2026\/04\/scythe-d06890b0_04202026_Edges_qty_54755.txt\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-bef5346b-f292-4aa5-adab-9dc0507e96b2\">Download<\/a><\/div>\n\n\n\n<div class=\"wp-block-file\"><a id=\"wp-block-file--media-b854c9d7-b447-4e4b-afd8-d63b18a9df3f\" href=\"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/wp-content\/uploads\/2026\/04\/scythe-d06890b0_04202026_Nodes_qty_21932.txt\">scythe-d06890b0_04202026_Nodes_qty_21932_4MB<\/a><a href=\"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/wp-content\/uploads\/2026\/04\/scythe-d06890b0_04202026_Nodes_qty_21932.txt\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-b854c9d7-b447-4e4b-afd8-d63b18a9df3f\">Download<\/a><\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"464\" height=\"382\" src=\"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/wp-content\/uploads\/2026\/04\/image-59.png\" alt=\"\" class=\"wp-image-5743\" srcset=\"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/wp-content\/uploads\/2026\/04\/image-59.png 464w, https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/wp-content\/uploads\/2026\/04\/image-59-300x247.png 300w\" sizes=\"auto, (max-width: 464px) 100vw, 464px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>SCYTHE_ROUTE\n&#91;21:37:22]&nbsp;FTP Ingest (172.234.197.23): Ingested 5 PCAPs \u2192 222 sessions, 1095 nodes, 2764 edges\n&#91;21:37:28]&nbsp;&#91;FTP Ingest] Created 185 Recon Entities from PCAP hosts\n&#91;21:37:28]&nbsp;&#91;FTP Ingest] Camera tracking primary host: 2.57.122.196\n&#91;21:37:28]&nbsp;&#91;Post-Ingest] Evidence gate opened. Starting re-materialization pipeline...\n&#91;21:37:29]&nbsp;Loaded 7 FTP PCAPs with 237 total sessions\n&#91;21:37:35]&nbsp;&#91;FTP Load] Created 193 Recon Entities from PCAP hosts\n&#91;21:37:35]&nbsp;&#91;FTP Load] Camera tracking primary host: 2.57.122.196\n&#91;21:37:35]&nbsp;DPI Enrichment: 2 DNS names\n&#91;21:37:35]&nbsp;&#91;Post-Ingest] Session list reloaded from graph\n&#91;21:37:36]&nbsp;&#91;Post-Ingest] BSG auto-detected: 3 behavioral groups\n&#91;21:37:37]&nbsp;&#91;Post-Ingest] GraphOps memory re-synchronized\n&#91;21:37:37]&nbsp;&#91;Post-Ingest] Re-materialization pipeline complete\n21:37:51]&nbsp;Loading Auto-Recon entities...\n&#91;21:37:58]&nbsp;Loaded 201 reconnaissance entities\n&#91;21:37:59]&nbsp;\u26a0\ufe0f 1 proximity alerts active!\n&#91;21:54:10]&nbsp;Traceroute \u2192 51.224.144.61\n&#91;21:54:18]&nbsp;18 hops\n&#91;21:54:18]&nbsp;Hop 1: \ud83d\udce1XCI55AX.mynetworksettings.com \u2014 1.47ms &#91;rf_link] \u2298dist\n&#91;21:54:18]&nbsp;Hop 2: \ud83d\udd0410.184.141.2 \u2014 243.79ms &#91;mimo_reassembly] \u26a1 MIMO \u2298dist\n&#91;21:54:18]&nbsp;Hop 3: \u2699\ufe0f10.184.141.2 \u2014 54.85ms &#91;packet_core] \u26a0 priv \u2298dist\n&#91;21:54:18]&nbsp;Hop 4: \u2699\ufe0f10.184.141.1 \u2014 54.85ms &#91;packet_core] \u26a0 priv \u2298dist\n&#91;21:54:18]&nbsp;Hop 5: \ud83d\udd00234.qarestr.sub-172-19-2.myvzw.com \u2014 54.85ms &#91;cgnat_cluster] \u26a0 spike \u2298dist\n&#91;21:54:18]&nbsp;Hop 6: \ud83c\udfd7\ufe0f185.sub-69-83-101.myvzw.com \u2014 54.85ms &#91;mpls_private_backbone] \u26a0 spike \u2298dist\n&#91;21:54:18]&nbsp;Hop 7: \ud83c\udfd7\ufe0f187.sub-69-83-101.myvzw.com \u2014 30.84ms &#91;mpls_private_backbone] \u26a0 spike \u2298dist\n&#91;21:54:18]&nbsp;Hop 9: \ud83c\udfd7\ufe0f212.sub-69-83-96.myvzw.com \u2014 33.97ms &#91;mpls_private_backbone] \u26a0 spike \u2298dist\n&#91;21:54:18]&nbsp;Hop 10: \ud83c\udfd7\ufe0f75.sub-69-83-97.myvzw.com \u2014 31.7ms &#91;mpls_private_backbone] \u26a0 spike \u2298dist\n&#91;21:54:18]&nbsp;Hop 13: \ud83d\udd0cdls-bb1-link.ip.twelve99.net \u2014 26.86ms +1678.8km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 14: \ud83d\udd0cnash-bb1-link.ip.twelve99.net \u2014 43.98ms +2748.8km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 15: \ud83d\udd0catl-bb1-link.ip.twelve99.net \u2014 51.8ms +3237.5km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 16: \ud83d\udd0crest-bb1-link.ip.twelve99.net \u2014 66.84ms +4177.5km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 17: \ud83d\udd0cash-b2-link.ip.twelve99.net \u2014 154.36ms +9647.5km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 18: \ud83d\udd0cash-bb2-link.ip.twelve99.net \u2014 68.5ms +4281.2km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 19: \ud83d\udd0cprs-bb2-link.ip.twelve99.net \u2014 151.83ms +9489.4km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 20: \ud83d\udd0cprs-b3-link.ip.twelve99.net \u2014 152.55ms +9534.4km &#91;access_router] \u26a0 spike\n&#91;21:54:18]&nbsp;Hop 30: \ud83c\udfafec2-51-224-144-61.eusc-de-east-1.compute.amazonaws.eu \u2014 183.37ms +11460.6km &#91;destination] \u26a0 spike\n&#91;21:54:18]&nbsp;\ud83d\udd34 5G MIMO path detected \u2014 early hops excluded from distance\n&#91;21:54:18]&nbsp;\ud83d\udccf Distance hops: 9 of 18 usable\n&#91;21:54:18]&nbsp;Total: ~9168.5 km from server\n&#91;21:54:18]&nbsp;\ud83c\udf10 3 trace entities on globe (6 logical segments)\n&#91;22:01:06]&nbsp;Starting scan on 51.224.144.61...\n&#91;22:01:06]&nbsp;Initiating enhanced nmap scan on 51.224.144.61...\n&#91;22:01:06]&nbsp;Command: nmap --traceroute 51.224.144.61\n&#91;22:01:06]&nbsp;Sending request to \/api\/nmap\/scan...\n&#91;22:03:06]&nbsp;Backend scan completed successfully\n&#91;22:03:13]&nbsp;Traceroute: 18 hops (1 clean, 17 anomalous)\n&#91;22:03:13]&nbsp;Hop 1: XCI55AX.mynetworksettings.com \u2014 1.3ms +65km\n&#91;22:03:13]&nbsp;Hop 2: 10.184.141.2 \u2014 46.03ms \u26a0 private_backbone\n&#91;22:03:13]&nbsp;Hop 3: 10.184.141.2 \u2014 46.01ms \u26a0 private_backbone\n&#91;22:03:13]&nbsp;Hop 4: 10.184.141.1 \u2014 44.06ms \u26a0 private_backbone\n&#91;22:03:13]&nbsp;Hop 5: 234.qarestr.sub-172-19-2.myvzw.com \u2014 44.18ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 7: 187.sub-69-83-101.myvzw.com \u2014 43.15ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 8: 177.sub-69-83-101.myvzw.com \u2014 44.28ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 9: 212.sub-69-83-96.myvzw.com \u2014 38.2ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 10: 75.sub-69-83-97.myvzw.com \u2014 36.37ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 13: dls-bb1-link.ip.twelve99.net \u2014 25.93ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 14: nash-bb1-link.ip.twelve99.net \u2014 51.5ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 15: atl-bb1-link.ip.twelve99.net \u2014 49.69ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 16: rest-bb1-link.ip.twelve99.net \u2014 64.66ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 17: ash-b2-link.ip.twelve99.net \u2014 151.64ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 18: ash-bb2-link.ip.twelve99.net \u2014 70.38ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 19: prs-bb2-link.ip.twelve99.net \u2014 159.66ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 20: prs-b3-link.ip.twelve99.net \u2014 151.56ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;Hop 30: ec2-51-224-144-61.eusc-de-east-1.compute.amazonaws.eu \u2014 172.95ms \u26a0 rtt_spike\n&#91;22:03:13]&nbsp;\ud83d\udccf Path distance: ~8647.5 km (min-RTT estimate, anomalous hops excluded)\n&#91;22:03:17]&nbsp;\ud83c\udfaf Ping: min 166ms \u2192 ~5187.5 km (4657.4\u20135717.6 km) conf 94%<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\ud83e\udde0 CLUSTER_SCYTHE INTEL\nClusters: 58\nThreats: 4\nRF emitters: 0\nUAVs: 0\nC2: 0\n\u26ab Quiet\nHIGH 60%\nCluster: swarm-c108ff10\nNodes: 9\nBehavior: MIXED\nASN: AS138915 \u2014 Kaopu Cloud HK Limited\nCountry: SG\nMobility: Fixed infrastructure\nLocation: 1.294\u00b0, 103.846\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS138915 \u2014 Kaopu Cloud HK Limited (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS138915 (Kaopu Cloud HK Limited) \u26a0 mixed infra (4 ASNs, 25% confidence) \u00b7 Jurisdiction: SG\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u2192 &#91;MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster \u2014 mixed infrastructure indicates distributed operation\n\u26ab Quiet\nHIGH 60%\nCluster: swarm-5c2e3a0a\nNodes: 13\nBehavior: MIXED\nASN: AS71 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (40% conf) \u00b7 4 ASNs\nCountry: GB\nMobility: Fixed infrastructure\nLocation: 51.510\u00b0, -0.108\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS71 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS71 (Amazon.com, Inc.) &#91;Hyperscaler] \u26a0 mixed infra (4 ASNs, 40% confidence) \u00b7 Jurisdiction: GB\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nHIGH 60%\nCluster: swarm-8565ce42\nNodes: 228\nBehavior: MIXED\nASN: AS203771 \u2014 Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi\nCountry: TR\nMobility: Fixed infrastructure\nLocation: 41.012\u00b0, 28.980\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS203771 \u2014 Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS203771 (Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi) \u26a0 mixed infra (4 ASNs, 34% confidence) \u00b7 Jurisdiction: TR\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u2192 &#91;MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster \u2014 mixed infrastructure indicates distributed operation\n\u26ab Quiet\nHIGH 60%\nCluster: swarm-ded8abbd\nNodes: 10\nBehavior: MIXED\nASN: AS48090 \u2014 Techoff Srv Limited\nCountry: NL\nMobility: Fixed infrastructure\nLocation: 52.379\u00b0, 4.899\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS48090 \u2014 Techoff Srv Limited (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS48090 (Techoff Srv Limited) \u26a0 mixed infra (4 ASNs, 25% confidence) \u00b7 Jurisdiction: NL\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u2192 &#91;MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster \u2014 mixed infrastructure indicates distributed operation\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-b8afacf0\nNodes: 18\nBehavior: MIXED\nASN: AS16276 \u2014 OVH SAS\nInfra: VPS Provider (63% conf) \u00b7 3 ASNs\nCountry: FR\nMobility: Fixed infrastructure\nLocation: 48.858\u00b0, 2.340\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16276 \u2014 OVH SAS (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16276 (OVH SAS) &#91;VPS Provider] \u00b7 Jurisdiction: FR\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-eea8f7a5\nNodes: 10\nBehavior: MIXED\nASN: AS31377 \u2014 Akamai Connected Cloud\nInfra: Edge CDN (75% conf) \u00b7 2 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 41.873\u00b0, -87.630\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS31377 \u2014 Akamai Connected Cloud (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS31377 (Akamai Connected Cloud) &#91;Edge CDN] \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-1417b7c6\nNodes: 10\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (50% conf) \u00b7 3 ASNs\nCountry: JP\nMobility: Fixed infrastructure\nLocation: 35.690\u00b0, 139.690\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: JP\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-501bd393\nNodes: 13\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (67% conf) \u00b7 2 ASNs\nCountry: SE\nMobility: Fixed infrastructure\nLocation: 59.329\u00b0, 18.072\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: SE\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-68bcb848\nNodes: 7\nBehavior: MIXED\nASN: AS32392 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (33% conf) \u00b7 3 ASNs\nCountry: IN\nMobility: Fixed infrastructure\nLocation: 17.384\u00b0, 78.458\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS32392 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS32392 (Amazon.com, Inc.) &#91;Hyperscaler] \u26a0 mixed infra (3 ASNs, 33% confidence) \u00b7 Jurisdiction: IN\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-77c1dfab\nNodes: 9\nBehavior: MIXED\nASN: AS23470 \u2014 ReliableSite.Net LLC\nCountry: US\nMobility: Fixed infrastructure\nLocation: 40.623\u00b0, -74.215\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS23470 \u2014 ReliableSite.Net LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS23470 (ReliableSite.Net LLC) \u26a0 mixed infra (3 ASNs, 33% confidence) \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-6b834a9d\nNodes: 7\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (67% conf) \u00b7 2 ASNs\nCountry: ES\nMobility: Fixed infrastructure\nLocation: 41.658\u00b0, -0.878\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: ES\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-1b36b68b\nNodes: 11\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (100% conf)\nCountry: NZ\nMobility: Fixed infrastructure\nLocation: -36.850\u00b0, 174.768\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: NZ\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-29cc34ed\nNodes: 14\nBehavior: MIXED\nASN: AS13335 \u2014 Cloudflare, Inc.\nInfra: Edge CDN (83% conf) \u00b7 2 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 29.766\u00b0, -95.394\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS13335 \u2014 Cloudflare, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS13335 (Cloudflare, Inc.) &#91;Edge CDN] \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-c5c41b3b\nNodes: 3\nBehavior: MIXED\nASN: AS10396 \u2014 DATACOM CARIBE, INC.\nCountry: PR\nMobility: Fixed infrastructure\nLocation: 18.404\u00b0, -66.149\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS10396 \u2014 DATACOM CARIBE, INC. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS10396 (DATACOM CARIBE, INC.) \u00b7 Jurisdiction: PR\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-08a8b532\nNodes: 3\nBehavior: MIXED\nASN: AS42821 \u2014 Feo Prest SRL\nCountry: TW\nMobility: Fixed infrastructure\nLocation: 24.000\u00b0, 121.000\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS42821 \u2014 Feo Prest SRL (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS42821 (Feo Prest SRL) \u00b7 Jurisdiction: TW\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-7b3479de\nNodes: 5\nBehavior: MIXED\nASN: AS8897 \u2014 Valence Technology Co.\nCountry: US\nMobility: Fixed infrastructure\nLocation: 37.751\u00b0, -97.822\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8897 \u2014 Valence Technology Co. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8897 (Valence Technology Co.) \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-0c174242\nNodes: 19\nBehavior: MIXED\nASN: AS47890 \u2014 Unmanaged Ltd\nCountry: RO\nMobility: Fixed infrastructure\nLocation: 45.997\u00b0, 24.997\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS47890 \u2014 Unmanaged Ltd (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS47890 (Unmanaged Ltd) \u00b7 Jurisdiction: RO\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-3c8596bd\nNodes: 7\nBehavior: MIXED\nASN: AS8612 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (100% conf)\nCountry: MX\nMobility: Fixed infrastructure\nLocation: 20.588\u00b0, -100.388\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8612 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8612 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: MX\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-418188e5\nNodes: 7\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (100% conf)\nCountry: CA\nMobility: Fixed infrastructure\nLocation: 51.050\u00b0, -114.088\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: CA\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-390f6cef\nNodes: 17\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (100% conf)\nCountry: DE\nMobility: Fixed infrastructure\nLocation: 52.520\u00b0, 13.407\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: DE\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-b7929cca\nNodes: 9\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (75% conf) \u00b7 2 ASNs\nCountry: JP\nMobility: Fixed infrastructure\nLocation: 34.693\u00b0, 135.500\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: JP\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-c9adcd15\nNodes: 43\nBehavior: MIXED\nASN: AS203771 \u2014 Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi\nCountry: IN\nMobility: Fixed infrastructure\nLocation: 19.075\u00b0, 72.886\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS203771 \u2014 Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS203771 (Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi) \u00b7 Jurisdiction: IN\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-81dd6f38\nNodes: 1282\nBehavior: MIXED\nASN: AS271410 \u2014 Smart Servico de Internet Ltda\nCountry: BR\nMobility: Fixed infrastructure\nLocation: -23.629\u00b0, -46.635\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS271410 \u2014 Smart Servico de Internet Ltda (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS271410 (Smart Servico de Internet Ltda) \u00b7 Jurisdiction: BR\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-27e4ee46\nNodes: 6\nBehavior: MIXED\nASN: AS31549 \u2014 Dade Samane Fanava Company (PJS)\nCountry: IR\nMobility: Fixed infrastructure\nLocation: 35.690\u00b0, 51.414\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS31549 \u2014 Dade Samane Fanava Company (PJS) (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS31549 (Dade Samane Fanava Company (PJS)) \u00b7 Jurisdiction: IR\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-0e82d452\nNodes: 13\nBehavior: MIXED\nASN: AS55960 \u2014 Beijing Guanghuan Xinwang Digital\nCountry: CN\nMobility: Fixed infrastructure\nLocation: 39.911\u00b0, 116.395\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS55960 \u2014 Beijing Guanghuan Xinwang Digital (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS55960 (Beijing Guanghuan Xinwang Digital) \u00b7 Jurisdiction: CN\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-8ee7be51\nNodes: 21\nBehavior: MIXED\nASN: AS24940 \u2014 Hetzner Online GmbH\nInfra: VPS Provider (60% conf) \u00b7 5 ASNs\nCountry: DE\nMobility: Fixed infrastructure\nLocation: 50.478\u00b0, 12.365\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS24940 \u2014 Hetzner Online GmbH (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS24940 (Hetzner Online GmbH) &#91;VPS Provider] \u00b7 Jurisdiction: DE\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-60b1c65e\nNodes: 5\nBehavior: MIXED\nASN: AS13414 \u2014 Twitter Inc.\nCountry: US\nMobility: Fixed infrastructure\nLocation: 33.770\u00b0, -84.375\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS13414 \u2014 Twitter Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS13414 (Twitter Inc.) \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-4a5bc8af\nNodes: 6\nBehavior: MIXED\nASN: AS7018 \u2014 AT&amp;T Enterprises, LLC\nInfra: ISP (50% conf) \u00b7 2 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 37.316\u00b0, -121.896\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS7018 \u2014 AT&amp;T Enterprises, LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS7018 (AT&amp;T Enterprises, LLC) &#91;ISP] \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-a099f9db\nNodes: 6\nBehavior: MIXED\nASN: AS152194 \u2014 CTG Server Limited\nCountry: HK\nMobility: Fixed infrastructure\nLocation: 22.271\u00b0, 114.171\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS152194 \u2014 CTG Server Limited (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS152194 (CTG Server Limited) \u00b7 Jurisdiction: HK\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-e79aaf60\nNodes: 3\nBehavior: MIXED\nASN: AS7018 \u2014 AT&amp;T Enterprises, LLC\nInfra: ISP (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 41.648\u00b0, -88.090\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS7018 \u2014 AT&amp;T Enterprises, LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS7018 (AT&amp;T Enterprises, LLC) &#91;ISP] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-7baa4a1e\nNodes: 3\nBehavior: MIXED\nASN: AS204880 \u2014 Stowarzyszenie Warszawski Hackerspace\nInfra: Hyperscaler (100% conf)\nCountry: PL\nMobility: Fixed infrastructure\nLocation: 52.239\u00b0, 21.036\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS204880 \u2014 Stowarzyszenie Warszawski Hackerspace (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS204880 (Stowarzyszenie Warszawski Hackerspace) &#91;Hyperscaler] \u00b7 Jurisdiction: PL\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-8501a8cc\nNodes: 3\nBehavior: MIXED\nASN: AS16276 \u2014 OVH SAS\nInfra: VPS Provider (100% conf)\nCountry: CA\nMobility: Fixed infrastructure\nLocation: 43.632\u00b0, -79.372\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16276 \u2014 OVH SAS (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16276 (OVH SAS) &#91;VPS Provider] \u00b7 Jurisdiction: CA\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-f3cc76ff\nNodes: 3\nBehavior: MIXED\nASN: AS16276 \u2014 OVH SAS\nInfra: VPS Provider (100% conf)\nCountry: CA\nMobility: Fixed infrastructure\nLocation: 45.506\u00b0, -73.579\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16276 \u2014 OVH SAS (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16276 (OVH SAS) &#91;VPS Provider] \u00b7 Jurisdiction: CA\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-d60281c0\nNodes: 3\nBehavior: MIXED\nASN: AS16276 \u2014 OVH SAS\nInfra: VPS Provider (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 38.881\u00b0, -77.301\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16276 \u2014 OVH SAS (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16276 (OVH SAS) &#91;VPS Provider] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-77aadc77\nNodes: 6\nBehavior: MIXED\nASN: AS5430 \u2014 netcup GmbH\nCountry: DE\nMobility: Fixed infrastructure\nLocation: 49.447\u00b0, 11.049\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS5430 \u2014 netcup GmbH (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS5430 (netcup GmbH) \u00b7 Jurisdiction: DE\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-5b806398\nNodes: 3\nBehavior: MIXED\nASN: AS40788 \u2014 Start Communications\nCountry: CA\nMobility: Fixed infrastructure\nLocation: 42.987\u00b0, -81.181\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS40788 \u2014 Start Communications (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS40788 (Start Communications) \u00b7 Jurisdiction: CA\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-e71b4778\nNodes: 5\nBehavior: MIXED\nASN: AS214139 \u2014 Private.coffee- Verein zur Forderung von Privatsphare und digitaler Souveranitat\nCountry: BE\nMobility: Fixed infrastructure\nLocation: 50.852\u00b0, 4.346\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS214139 \u2014 Private.coffee- Verein zur Forderung von Privatsphare und digitaler Souveranitat (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS214139 (Private.coffee- Verein zur Forderung von Privatsphare und digitaler Souveranitat) \u00b7 Jurisdiction: BE\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-5ea2d20a\nNodes: 3\nBehavior: MIXED\nASN: AS19529 \u2014 The Constant Company, LLC\nCountry: AU\nMobility: Fixed infrastructure\nLocation: -37.816\u00b0, 144.967\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS19529 \u2014 The Constant Company, LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS19529 (The Constant Company, LLC) \u00b7 Jurisdiction: AU\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-61e1337e\nNodes: 9\nBehavior: MIXED\nASN: AS14618 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (75% conf) \u00b7 2 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 39.047\u00b0, -77.490\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS14618 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS14618 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-9ad4c5e5\nNodes: 3\nBehavior: MIXED\nASN: AS12392 \u2014 VOO S.A.\nCountry: BE\nMobility: Fixed infrastructure\nLocation: 50.698\u00b0, 5.598\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS12392 \u2014 VOO S.A. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS12392 (VOO S.A.) \u00b7 Jurisdiction: BE\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-1356e469\nNodes: 3\nBehavior: MIXED\nASN: AS3356 \u2014 Alibaba US Technology Co., Ltd.\nInfra: Backbone (100% conf)\nCountry: TH\nMobility: Fixed infrastructure\nLocation: 13.750\u00b0, 100.517\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS3356 \u2014 Alibaba US Technology Co., Ltd. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS3356 (Alibaba US Technology Co., Ltd.) &#91;Backbone] \u00b7 Jurisdiction: TH\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-83c3de80\nNodes: 5\nBehavior: MIXED\nASN: AS8649 \u2014 Hetzner Online GmbH\nInfra: VPS Provider (50% conf) \u00b7 2 ASNs\nCountry: FI\nMobility: Fixed infrastructure\nLocation: 60.172\u00b0, 24.935\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8649 \u2014 Hetzner Online GmbH (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8649 (Hetzner Online GmbH) &#91;VPS Provider] \u00b7 Jurisdiction: FI\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-722725ba\nNodes: 3\nBehavior: MIXED\nASN: AS7018 \u2014 AT&amp;T Enterprises, LLC\nInfra: ISP (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 27.318\u00b0, -80.352\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS7018 \u2014 AT&amp;T Enterprises, LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS7018 (AT&amp;T Enterprises, LLC) &#91;ISP] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-64a340ae\nNodes: 2472\nBehavior: MIXED\nASN: AS262880 \u2014 RADAR WISP LTDA\nCountry: BR\nMobility: Fixed infrastructure\nLocation: -16.289\u00b0, -49.016\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS262880 \u2014 RADAR WISP LTDA (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS262880 (RADAR WISP LTDA) \u00b7 Jurisdiction: BR\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-7e194104\nNodes: 3\nBehavior: MIXED\nASN: AS4766 \u2014 Korea Telecom\nInfra: ISP (100% conf)\nCountry: KR\nMobility: Fixed infrastructure\nLocation: 36.114\u00b0, 128.343\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS4766 \u2014 Korea Telecom (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS4766 (Korea Telecom) &#91;ISP] \u00b7 Jurisdiction: KR\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-48744087\nNodes: 3\nBehavior: MIXED\nASN: AS15169 \u2014 Google LLC\nInfra: Hyperscaler (100% conf)\nCountry: CH\nMobility: Fixed infrastructure\nLocation: 47.364\u00b0, 8.544\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS15169 \u2014 Google LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS15169 (Google LLC) &#91;Hyperscaler] \u00b7 Jurisdiction: CH\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-ba7f8443\nNodes: 49\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (50% conf) \u00b7 4 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 45.840\u00b0, -119.705\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-7705fff2\nNodes: 6\nBehavior: MIXED\nASN: AS216030 \u2014 GoodLeaf Hosting &amp; Development LLC\nCountry: US\nMobility: Fixed infrastructure\nLocation: 32.863\u00b0, -96.752\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS216030 \u2014 GoodLeaf Hosting &amp; Development LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS216030 (GoodLeaf Hosting &amp; Development LLC) \u00b7 Jurisdiction: US\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-622edeb8\nNodes: 5\nBehavior: MIXED\nASN: AS4812 \u2014 China Telecom Group\nInfra: ISP (100% conf)\nCountry: CN\nMobility: Fixed infrastructure\nLocation: 31.222\u00b0, 121.458\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS4812 \u2014 China Telecom Group (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS4812 (China Telecom Group) &#91;ISP] \u00b7 Jurisdiction: CN\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-cf233f95\nNodes: 3\nBehavior: MIXED\nASN: AS4837 \u2014 CHINA UNICOM China169 Backbone\nCountry: CN\nMobility: Fixed infrastructure\nLocation: 34.773\u00b0, 113.722\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS4837 \u2014 CHINA UNICOM China169 Backbone (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS4837 (CHINA UNICOM China169 Backbone) \u00b7 Jurisdiction: CN\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-744c4fe9\nNodes: 3\nBehavior: MIXED\nASN: AS22394 \u2014 Verizon Business\nInfra: ISP (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 38.958\u00b0, -85.888\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS22394 \u2014 Verizon Business (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS22394 (Verizon Business) &#91;ISP] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-63954e9e\nNodes: 3\nBehavior: MIXED\nASN: AS16637 \u2014 Edgenext Legend Dynasty Pte. Ltd.\nCountry: SC\nMobility: Fixed infrastructure\nLocation: -4.583\u00b0, 55.667\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16637 \u2014 Edgenext Legend Dynasty Pte. Ltd. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16637 (Edgenext Legend Dynasty Pte. Ltd.) \u00b7 Jurisdiction: SC\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-18a070b6\nNodes: 5\nBehavior: MIXED\nASN: AS7018 \u2014 China Mobile Communications Group Co., Ltd.\nInfra: ISP (50% conf) \u00b7 2 ASNs\nCountry: CN\nMobility: Fixed infrastructure\nLocation: 37.253\u00b0, 105.998\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS7018 \u2014 China Mobile Communications Group Co., Ltd. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS7018 (China Mobile Communications Group Co., Ltd.) &#91;ISP] \u00b7 Jurisdiction: CN\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-2f7574bb\nNodes: 3\nBehavior: MIXED\nASN: AS8849 \u2014 Melbikomas UAB\nCountry: NG\nMobility: Fixed infrastructure\nLocation: 6.447\u00b0, 3.390\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8849 \u2014 Melbikomas UAB (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8849 (Melbikomas UAB) \u00b7 Jurisdiction: NG\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-cc7ec209\nNodes: 3\nBehavior: MIXED\nASN: AS9198 \u2014 JSC Kazakhtelecom\nInfra: ISP (100% conf)\nCountry: KZ\nMobility: Fixed infrastructure\nLocation: 51.188\u00b0, 71.449\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS9198 \u2014 JSC Kazakhtelecom (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS9198 (JSC Kazakhtelecom) &#91;ISP] \u00b7 Jurisdiction: KZ\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-93eff2b3\nNodes: 3\nBehavior: MIXED\nASN: AS206406 \u2014 C BEYOND s.a.l\nCountry: LB\nMobility: Fixed infrastructure\nLocation: 33.892\u00b0, 35.502\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS206406 \u2014 C BEYOND s.a.l (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS206406 (C BEYOND s.a.l) \u00b7 Jurisdiction: LB\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-5011d4bd\nNodes: 3\nBehavior: MIXED\nASN: AS31291 \u2014 ColocaTel Inc.\nCountry: BG\nMobility: Fixed infrastructure\nLocation: 42.683\u00b0, 23.322\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS31291 \u2014 ColocaTel Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS31291 (ColocaTel Inc.) \u00b7 Jurisdiction: BG\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-1e66275c\nNodes: 332\nBehavior: MIXED\nASN: AS273470 \u2014 WORK TELECOM INTERNET LTDA\nInfra: ISP (100% conf)\nCountry: BR\nMobility: Fixed infrastructure\nLocation: -21.100\u00b0, -41.692\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS273470 \u2014 WORK TELECOM INTERNET LTDA (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS273470 (WORK TELECOM INTERNET LTDA) &#91;ISP] \u00b7 Jurisdiction: BR\n\u2192 &#91;LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n&#91;14:52:27]\u26abQuiet \u2014 332 nodes @ -21.10\u00b0,-41.69\u00b0 BR \u00b7 AS273470 (WORK TELECOM INTERNET LTDA) &#91;ISP] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 42.68\u00b0,23.32\u00b0 BG \u00b7 AS31291 (ColocaTel Inc.) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 33.89\u00b0,35.50\u00b0 LB \u00b7 AS206406 (C BEYOND s.a.l) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 51.19\u00b0,71.45\u00b0 KZ \u00b7 AS9198 (JSC Kazakhtelecom) &#91;ISP] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 6.45\u00b0,3.39\u00b0 NG \u00b7 AS8849 (Melbikomas UAB) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 5 nodes @ 37.25\u00b0,106.00\u00b0 CN \u00b7 AS7018 (China Mobile Communications Group Co., Ltd.) &#91;ISP] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ -4.58\u00b0,55.67\u00b0 SC \u00b7 AS16637 (Edgenext Legend Dynasty Pte. Ltd.) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 38.96\u00b0,-85.89\u00b0 US \u00b7 AS22394 (Verizon Business) &#91;ISP] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 34.77\u00b0,113.72\u00b0 CN \u00b7 AS4837 (CHINA UNICOM China169 Backbone) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 5 nodes @ 31.22\u00b0,121.46\u00b0 CN \u00b7 AS4812 (China Telecom Group) &#91;ISP] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 6 nodes @ 32.86\u00b0,-96.75\u00b0 US \u00b7 AS216030 (GoodLeaf Hosting &amp; Development LLC) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 49 nodes @ 45.84\u00b0,-119.70\u00b0 US \u00b7 AS16509 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 47.36\u00b0,8.54\u00b0 CH \u00b7 AS15169 (Google LLC) &#91;Hyperscaler] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 36.11\u00b0,128.34\u00b0 KR \u00b7 AS4766 (Korea Telecom) &#91;ISP] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 2472 nodes @ -16.29\u00b0,-49.02\u00b0 BR \u00b7 AS262880 (RADAR WISP LTDA) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 27.32\u00b0,-80.35\u00b0 US \u00b7 AS7018 (AT&amp;T Enterprises, LLC) &#91;ISP] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 5 nodes @ 60.17\u00b0,24.93\u00b0 FI \u00b7 AS8649 (Hetzner Online GmbH) &#91;VPS Provider] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 13.75\u00b0,100.52\u00b0 TH \u00b7 AS3356 (Alibaba US Technology Co., Ltd.) &#91;Backbone] \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 3 nodes @ 50.70\u00b0,5.60\u00b0 BE \u00b7 AS12392 (VOO S.A.) \u00b7 threat 50%\n&#91;14:52:27]\u26abQuiet \u2014 9 nodes @ 39.05\u00b0,-77.49\u00b0 US \u00b7 AS14618 (Amazon.com, Inc.) &#91;Hyperscaler] \u00b7 threat 50%<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\ud83c\udf10 INFRA_SCYTHE FLOW\nPaths: 191\nPhysical: 191\nSynthetic: 0\nCables: 10\nIX: 7\nConflicts: 0\nCSI: 0\nCascades: 0\n\ud83d\udc7b Phantoms: 0\nKill Chain: 0\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n\ud83d\udd17 Pacific Crossing-1\n\u26a1 JPNAP Tokyo\n9712 km\n\u26a1 IX AS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n\u26a1 AMS-IX Amsterdam, DE-CIX Frankfurt\n1544 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n\ud83d\udd17 MAREA, SEA-ME-WE 6, Pacific Crossing-1, Grace Hopper, Dunant, PEACE\n839 km\nAS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n18546 km\nAS16276 \u2192 AS133353 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS13335\n8086 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n\ud83d\udd17 Pacific Crossing-1\n7375 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n\ud83d\udd17 Grace Hopper\n\u26a1 DE-CIX Frankfurt, AMS-IX Amsterdam\n878 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n\ud83d\udd17 Pacific Crossing-1\n9634 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16276 \u2192 AS249403 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS24940\n\ud83d\udd17 Grace Hopper\n\u26a1 DE-CIX Frankfurt, AMS-IX Amsterdam\n743 km\n\u26a1 IX AS16276 \u2192 AS70183 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS7018\n\u26a1 Equinix SV (Palo Alto)\n8970 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16276 \u2192 AS70183 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS7018\n\ud83d\udd17 Pacific Crossing-1\n\u26a1 Equinix Chicago\n6695 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16276 \u2192 AS146183 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS14618\n\ud83d\udd17 MAREA, FLAG Atlantic-1, Pacific Crossing-1, Grace Hopper, Dunant\n\u26a1 Equinix Ashburn\n6185 km\nAS16276 \u2192 AS33562 hops \u00b7 0%\nAS16276 \u2192 AS3356\n9446 km\nAS16276 \u2192 AS70183 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS7018\n7246 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16276 \u2192 AS151693 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS15169\n\ud83d\udd17 SEA-ME-WE 6, FLAG Atlantic-1, Pacific Crossing-1, Grace Hopper, PEACE\n\u26a1 DE-CIX Frankfurt, AMS-IX Amsterdam\n489 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16276 \u2192 AS165093 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS16509\n\ud83d\udd17 Pacific Crossing-1\n8086 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16276 \u2192 AS48373 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS4837\n\ud83d\udd17 Pacific Crossing-1, PEACE\n8513 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16276 \u2192 AS70183 hops \u00b7 0%\nAS16276 \u2192 AS3356 \u2192 AS7018\n\ud83d\udd17 Pacific Crossing-1, PEACE\n7850 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16509 \u2192 AS133353 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS13335\n\ud83d\udd17 JUPITER\n\u26a1 JPNAP Tokyo\n10735 km\n\u26a1 IX AS16509 \u2192 AS249403 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS24940\n\u26a1 JPNAP Tokyo\n9134 km\n&#91;2:53:48 PM] \u2713 191 paths \u00b7 0 synthetic<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>April 30, 2026 | Ben Gilbert | Texas City<\/p>\n","protected":false},"author":2,"featured_media":5293,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"class_list":["post-5691","page","type-page","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/pages\/5691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5691"}],"version-history":[{"count":0,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/pages\/5691\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/media\/5293"}],"wp:attachment":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}