{"id":5885,"date":"2026-05-05T19:53:55","date_gmt":"2026-05-05T19:53:55","guid":{"rendered":"http:\/\/localhost:8080\/?page_id=5885"},"modified":"2026-05-05T21:19:20","modified_gmt":"2026-05-05T21:19:20","slug":"scythe-d624f767-session-e3c6dfcfc9e8d03b","status":"publish","type":"page","link":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/?page_id=5885","title":{"rendered":"scythe-d624f767 SESSION-e3c6dfcfc9e8d03b"},"content":{"rendered":"\n
session-hypergraph-SESSION-e3c6dfcf<\/a>Download<\/a><\/div>\n\n\n\n
scythe-d624f767_Nodes<\/a>Download<\/a><\/div>\n\n\n\n
scythe-d624f767_Edges<\/a>Download<\/a><\/div>\n\n\n\n
18 PCAPs \u2022 211 sessions \u2022 119 hosts \u2022 119 \ud83c\udf0d geolocated\n\u25b6 \ud83d\udcc4 capture_20260505020001.pcap 267.1 KB \u2022 18 sessions \u2022 ICMP:9 TCP:6 UDP:3\n\u25b6 \ud83d\udcc4 capture_20260505030001.pcap 2.7 KB \u2022 9 sessions \u2022 UDP:2 TCP:3 ICMP:4\n\u25b6 \ud83d\udcc4 capture_20260505040001.pcap 30.8 KB \u2022 12 sessions \u2022 UDP:5 TCP:6 ICMP:1\n\u25b6 \ud83d\udcc4 capture_20260505050001.pcap 17.0 KB \u2022 4 sessions \u2022 UDP:2 TCP:2\n\u25b6 \ud83d\udcc4 capture_20260505060001.pcap 18.0 KB \u2022 18 sessions \u2022 ICMP:9 UDP:2 TCP:7\n\u25b6 \ud83d\udcc4 capture_20260505070001.pcap 15.2 KB \u2022 7 sessions \u2022 UDP:2 ICMP:3 TCP:2\n\u25b6 \ud83d\udcc4 capture_20260505080001.pcap 8.3 KB \u2022 7 sessions \u2022 UDP:5 TCP:1 ICMP:1\n\u25b6 \ud83d\udcc4 capture_20260505090001.pcap 2.8 KB \u2022 9 sessions \u2022 UDP:2 TCP:1 ICMP:6\n\u25b6 \ud83d\udcc4 capture_20260505100001.pcap 41.7 KB \u2022 12 sessions \u2022 ICMP:4 TCP:5 UDP:3\n\u25b6 \ud83d\udcc4 capture_20260505110001.pcap 2.9 KB \u2022 8 sessions \u2022 ICMP:5 UDP:2 TCP:1\n\u25b6 \ud83d\udcc4 capture_20260505120001.pcap 28.0 KB \u2022 18 sessions \u2022 ICMP:9 UDP:4 TCP:5\n\u25b6 \ud83d\udcc4 capture_20260505130001.pcap 10.5 KB \u2022 7 sessions \u2022 TCP:3 UDP:2 ICMP:2\n\u25b6 \ud83d\udcc4 capture_20260505140001.pcap 4.6 KB \u2022 19 sessions \u2022 ICMP:16 UDP:2 TCP:1\n\u25b6 \ud83d\udcc4 capture_20260505150001.pcap 10.3 KB \u2022 16 sessions \u2022 UDP:2 ICMP:10 TCP:4\n\u25b6 \ud83d\udcc4 capture_20260505160001.pcap 4.4 KB \u2022 12 sessions \u2022 ICMP:8 UDP:2 TCP:2\n\u25b6 \ud83d\udcc4 capture_20260505170001.pcap 38.2 KB \u2022 19 sessions \u2022 ICMP:9 UDP:2 TCP:8\n\u25b6 \ud83d\udcc4 capture_20260505180001.pcap 7.4 KB \u2022 7 sessions \u2022 ICMP:4 UDP:2 TCP:1\n\u25b6 \ud83d\udcc4 capture_20260505190001.pcap 71.1 KB \u2022 9 sessions \u2022 TCP:4 UDP:5\n<\/code><\/pre>\n\n\n\n
\ud83c\udf10 INFRA FLOW\nPaths: 67\nPhysical: 67\nSynthetic: 0\nCables: 11\nIX: 6\nConflicts: 0\nCSI: 0\nCascades: 0\n\ud83d\udc7b Phantoms: 0\nKill Chain: 0\n\u26a1 IX AS16509 \u2192 AS1322033 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS132203\n\u26a1 Equinix Singapore\n13259 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16509 \u2192 AS162763 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS16276\n\ud83d\udd17 Pacific Crossing-1\n8086 km\nAS16509 \u2192 AS80753 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS8075\n3557 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS16509 \u2192 AS146183 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS14618\n\ud83d\udd17 Pacific Crossing-1\n\u26a1 Equinix Ashburn\n3503 km\nAS16509 \u2192 AS80753 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS8075\n2596 km\nAS16509 \u2192 AS80753 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS8075\n1523 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16509 \u2192 AS41343 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS4134\n\ud83d\udd17 Pacific Crossing-1\n9573 km\n\u26a1 IX AS132203 \u2192 AS165093 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS16509\n\u26a1 Equinix Singapore\n13183 km\n\u26a1 IX AS132203 \u2192 AS165093 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS16509\n\u26a1 Equinix Singapore\n9921 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS132203 \u2192 AS162763 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS16276\n\ud83d\udd17 SEA-ME-WE 6\n\u26a1 Equinix Singapore\n10735 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS132203 \u2192 AS80753 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS8075\n\ud83d\udd17 AAG (Asia-America Gateway)\n\u26a1 Equinix Singapore\n15786 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS132203 \u2192 AS146183 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS14618\n\ud83d\udd17 AAG (Asia-America Gateway)\n\u26a1 Equinix Singapore, Equinix Ashburn\n15526 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS132203 \u2192 AS165093 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS16509\n\ud83d\udd17 AAG (Asia-America Gateway)\n\u26a1 Equinix Singapore, Equinix SV (Palo Alto)\n13650 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS132203 \u2192 AS80753 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS8075\n\ud83d\udd17 AAG (Asia-America Gateway)\n\u26a1 Equinix Singapore\n15855 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE\u26a1 IX AS132203 \u2192 AS80753 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS8075\n\ud83d\udd17 AAG (Asia-America Gateway)\n\u26a1 Equinix Singapore\n14625 km\n\u26a1 IX AS132203 \u2192 AS165093 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS16509\n\u26a1 Equinix Singapore\n11205 km\n\u26a1 IX AS132203 \u2192 AS41342 hops \u00b7 0%\nAS132203 \u2192 AS4134\n\u26a1 Equinix Singapore\n3860 km\n\u26a1 IX AS132203 \u2192 AS165093 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS16509\n\u26a1 Equinix Singapore\n6300 km\n\u26a1 IX AS132203 \u2192 AS165093 hops \u00b7 0%\nAS132203 \u2192 AS3356 \u2192 AS16509\n\u26a1 Equinix Singapore\n15374 km\n\u2713 PHYSICAL\ud83d\udd17 CABLE AS16509 \u2192 AS162763 hops \u00b7 0%\nAS16509 \u2192 AS3356 \u2192 AS16276\n\ud83d\udd17 Pacific Crossing-1\n7375 km\n[4:16:39 PM] \u2713 67 paths \u00b7 0 synthetic<\/code><\/pre>\n\n\n\n
\ud83e\udde0 CLUSTER INTEL\nClusters: 35\nThreats: 2\nRF emitters: 0\nUAVs: 0\nC2: 0\n\u26ab Quiet\nHIGH 60%\nCluster: swarm-f3cc76ff\nNodes: 10\nBehavior: MIXED\nASN: AS26832 \u2014 Rica Web Services\nCountry: CA\nMobility: Fixed infrastructure\nLocation: 45.488\u00b0, -73.599\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS26832 \u2014 Rica Web Services (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS26832 (Rica Web Services) \u26a0 mixed infra (4 ASNs, 25% confidence) \u00b7 Jurisdiction: CA\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u2192 [MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster \u2014 mixed infrastructure indicates distributed operation\n\u26ab Quiet\nHIGH 60%\nCluster: swarm-ba7f8443\nNodes: 13\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (33% conf) \u00b7 4 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 45.840\u00b0, -119.705\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] \u26a0 mixed infra (4 ASNs, 33% confidence) \u00b7 Jurisdiction: US\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u2192 [MEDIUM] ANALYZE_MULTI_ASN: 4 distinct ASNs in cluster \u2014 mixed infrastructure indicates distributed operation\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-c108ff10\nNodes: 18\nBehavior: MIXED\nASN: AS132203 \u2014 Tencent Building, Kejizhongyi Avenue\nInfra: Hyperscaler (50% conf) \u00b7 4 ASNs\nCountry: SG\nMobility: Fixed infrastructure\nLocation: 1.306\u00b0, 103.838\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS132203 \u2014 Tencent Building, Kejizhongyi Avenue (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS132203 (Tencent Building, Kejizhongyi Avenue) [Hyperscaler] \u00b7 Jurisdiction: SG\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-eea8f7a5\nNodes: 5\nBehavior: MIXED\nASN: AS31377 \u2014 Akamai Connected Cloud\nInfra: Edge CDN (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 41.883\u00b0, -87.630\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS31377 \u2014 Akamai Connected Cloud (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS31377 (Akamai Connected Cloud) [Edge CDN] \u00b7 Jurisdiction: US\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-418188e5\nNodes: 7\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (67% conf) \u00b7 2 ASNs\nCountry: CA\nMobility: Fixed infrastructure\nLocation: 51.050\u00b0, -114.088\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: CA\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-390f6cef\nNodes: 25\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (100% conf)\nCountry: DE\nMobility: Fixed infrastructure\nLocation: 52.520\u00b0, 13.407\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: DE\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-ded8abbd\nNodes: 9\nBehavior: MIXED\nASN: AS48090 \u2014 Techoff Srv Limited\nCountry: NL\nMobility: Fixed infrastructure\nLocation: 52.376\u00b0, 4.897\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS48090 \u2014 Techoff Srv Limited (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS48090 (Techoff Srv Limited) \u00b7 Jurisdiction: NL\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-b8afacf0\nNodes: 6\nBehavior: MIXED\nASN: AS16276 \u2014 OVH SAS\nInfra: VPS Provider (50% conf) \u00b7 2 ASNs\nCountry: FR\nMobility: Fixed infrastructure\nLocation: 48.857\u00b0, 2.344\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16276 \u2014 OVH SAS (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16276 (OVH SAS) [VPS Provider] \u00b7 Jurisdiction: FR\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-eba7d729\nNodes: 9\nBehavior: MIXED\nASN: AS8075 \u2014 Microsoft Corporation\nInfra: Hyperscaler (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 36.669\u00b0, -78.388\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8075 \u2014 Microsoft Corporation (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8075 (Microsoft Corporation) [Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-61e1337e\nNodes: 35\nBehavior: MIXED\nASN: AS14618 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (71% conf) \u00b7 4 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 39.047\u00b0, -77.490\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS14618 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS14618 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-81c243b4\nNodes: 3\nBehavior: MIXED\nASN: AS55720 \u2014 Gigabit Hosting Sdn Bhd\nCountry: MY\nMobility: Fixed infrastructure\nLocation: 3.140\u00b0, 101.701\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS55720 \u2014 Gigabit Hosting Sdn Bhd (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS55720 (Gigabit Hosting Sdn Bhd) \u00b7 Jurisdiction: MY\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-29cc34ed\nNodes: 3\nBehavior: MIXED\nASN: AS6167 \u2014 Verizon Business\nInfra: ISP (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 29.812\u00b0, -95.521\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS6167 \u2014 Verizon Business (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS6167 (Verizon Business) [ISP] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-0c174242\nNodes: 11\nBehavior: MIXED\nASN: AS47890 \u2014 Unmanaged Ltd\nCountry: RO\nMobility: Fixed infrastructure\nLocation: 45.997\u00b0, 24.997\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS47890 \u2014 Unmanaged Ltd (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS47890 (Unmanaged Ltd) \u00b7 Jurisdiction: RO\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-c1d470a8\nNodes: 3\nBehavior: MIXED\nASN: AS200019 \u2014 Alexhost Srl\nCountry: MD\nMobility: Fixed infrastructure\nLocation: 47.019\u00b0, 28.813\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS200019 \u2014 Alexhost Srl (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS200019 (Alexhost Srl) \u00b7 Jurisdiction: MD\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-5c2e3a0a\nNodes: 9\nBehavior: MIXED\nASN: AS41231 \u2014 Canonical Group Limited\nCountry: GB\nMobility: Fixed infrastructure\nLocation: 51.496\u00b0, -0.122\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS41231 \u2014 Canonical Group Limited (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS41231 (Canonical Group Limited) \u00b7 Jurisdiction: GB\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-0ad0ed50\nNodes: 3\nBehavior: MIXED\nASN: AS2514 \u2014 GMO-Z.com Runsystem Joint Stock Company\nCountry: VN\nMobility: Fixed infrastructure\nLocation: 16.167\u00b0, 107.833\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS2514 \u2014 GMO-Z.com Runsystem Joint Stock Company (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS2514 (GMO-Z.com Runsystem Joint Stock Company) \u00b7 Jurisdiction: VN\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-2892768f\nNodes: 3\nBehavior: MIXED\nASN: AS197834 \u2014 Ucom CJSC\nCountry: AM\nMobility: Fixed infrastructure\nLocation: 40.250\u00b0, 45.000\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS197834 \u2014 Ucom CJSC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS197834 (Ucom CJSC) \u00b7 Jurisdiction: AM\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-6f76090a\nNodes: 3\nBehavior: MIXED\nASN: AS44050 \u2014 Petersburg Internet Network ltd.\nCountry: RU\nMobility: Fixed infrastructure\nLocation: 55.739\u00b0, 37.607\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS44050 \u2014 Petersburg Internet Network ltd. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS44050 (Petersburg Internet Network ltd.) \u00b7 Jurisdiction: RU\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-4a5bc8af\nNodes: 13\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (83% conf) \u00b7 2 ASNs\nCountry: US\nMobility: Fixed infrastructure\nLocation: 37.339\u00b0, -121.892\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-5273d558\nNodes: 3\nBehavior: MIXED\nASN: AS8075 \u2014 Microsoft Corporation\nInfra: Hyperscaler (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 29.423\u00b0, -98.493\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8075 \u2014 Microsoft Corporation (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8075 (Microsoft Corporation) [Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-7961a5ae\nNodes: 3\nBehavior: MIXED\nASN: AS8075 \u2014 Microsoft Corporation\nInfra: Hyperscaler (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 33.453\u00b0, -112.075\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8075 \u2014 Microsoft Corporation (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8075 (Microsoft Corporation) [Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-0450207d\nNodes: 3\nBehavior: MIXED\nASN: AS214940 \u2014 Kprohost LLC\nCountry: UA\nMobility: Fixed infrastructure\nLocation: 50.452\u00b0, 30.529\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS214940 \u2014 Kprohost LLC (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS214940 (Kprohost LLC) \u00b7 Jurisdiction: UA\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-56028ea3\nNodes: 9\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (50% conf) \u00b7 3 ASNs\nCountry: IE\nMobility: Fixed infrastructure\nLocation: 53.338\u00b0, -6.259\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: IE\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-cceef2cd\nNodes: 3\nBehavior: MIXED\nASN: AS8010 \u2014 PenTeleData Inc.\nCountry: US\nMobility: Fixed infrastructure\nLocation: 41.578\u00b0, -75.255\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8010 \u2014 PenTeleData Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8010 (PenTeleData Inc.) \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-7b3479de\nNodes: 7\nBehavior: MIXED\nASN: AS54641 \u2014 InMotion Hosting, Inc.\nCountry: US\nMobility: Fixed infrastructure\nLocation: 37.751\u00b0, -97.822\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS54641 \u2014 InMotion Hosting, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS54641 (InMotion Hosting, Inc.) \u26a0 mixed infra (3 ASNs, 33% confidence) \u00b7 Jurisdiction: US\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-cf233f95\nNodes: 9\nBehavior: MIXED\nASN: AS4134 \u2014 CHINANET Guangdong province network\nCountry: CN\nMobility: Fixed infrastructure\nLocation: 34.773\u00b0, 113.722\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS4134 \u2014 CHINANET Guangdong province network (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS4134 (CHINANET Guangdong province network) \u00b7 Jurisdiction: CN\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-8052a076\nNodes: 3\nBehavior: MIXED\nASN: AS3215 \u2014 Orange\nCountry: FR\nMobility: Fixed infrastructure\nLocation: 43.722\u00b0, 7.118\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS3215 \u2014 Orange (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS3215 (Orange) \u00b7 Jurisdiction: FR\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-63d1d285\nNodes: 23\nBehavior: MIXED\nASN: AS6389 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (73% conf) \u00b7 3 ASNs\nCountry: ID\nMobility: Fixed infrastructure\nLocation: -6.211\u00b0, 106.845\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS6389 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS6389 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: ID\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-cd13a4db\nNodes: 7\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (67% conf) \u00b7 2 ASNs\nCountry: AU\nMobility: Fixed infrastructure\nLocation: -33.867\u00b0, 151.200\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: AU\n\u2192 [LOW] SCHEDULE_RESCAN: Large dormant cluster \u2014 may be staging infrastructure\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-c30796c1\nNodes: 3\nBehavior: MIXED\nASN: AS8649 \u2014 Dedik Services Limited\nCountry: DE\nMobility: Fixed infrastructure\nLocation: 51.299\u00b0, 9.491\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS8649 \u2014 Dedik Services Limited (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS8649 (Dedik Services Limited) \u00b7 Jurisdiction: DE\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-756b0eb2\nNodes: 3\nBehavior: MIXED\nASN: AS328436 \u2014 Flashnet-Technologies-Limited\nCountry: TZ\nMobility: Fixed infrastructure\nLocation: -6.823\u00b0, 39.291\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS328436 \u2014 Flashnet-Technologies-Limited (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS328436 (Flashnet-Technologies-Limited) \u00b7 Jurisdiction: TZ\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-b120604a\nNodes: 3\nBehavior: MIXED\nASN: AS272809 \u2014 THUNDERNET, C.A.\nCountry: VE\nMobility: Fixed infrastructure\nLocation: 10.487\u00b0, -66.874\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS272809 \u2014 THUNDERNET, C.A. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS272809 (THUNDERNET, C.A.) \u00b7 Jurisdiction: VE\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-63954e9e\nNodes: 3\nBehavior: MIXED\nASN: AS198193 \u2014 Amarutu Technology Ltd\nCountry: SC\nMobility: Fixed infrastructure\nLocation: -4.583\u00b0, 55.667\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS198193 \u2014 Amarutu Technology Ltd (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS198193 (Amarutu Technology Ltd) \u00b7 Jurisdiction: SC\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-974e5955\nNodes: 3\nBehavior: MIXED\nASN: AS4766 \u2014 Korea Telecom\nInfra: ISP (100% conf)\nCountry: KR\nMobility: Fixed infrastructure\nLocation: 34.571\u00b0, 126.601\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS4766 \u2014 Korea Telecom (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS4766 (Korea Telecom) [ISP] \u00b7 Jurisdiction: KR\n\u2192 Awaiting sufficient data\n\u26ab Quiet\nMEDIUM 50%\nCluster: swarm-66e8dfae\nNodes: 3\nBehavior: MIXED\nASN: AS16509 \u2014 Amazon.com, Inc.\nInfra: Hyperscaler (100% conf)\nCountry: US\nMobility: Fixed infrastructure\nLocation: 39.962\u00b0, -83.006\u00b0 \ud83c\udf0d Fly To \ud83d\udd2c AUTOPSY\ud83d\udce6 BUNDLE\n\u23f1 Phase: 0%\nProp: INSUFFICIENT_DATA\n\u26a1 Control Origin: AS16509 \u2014 Amazon.com, Inc. (0% \u00b7 cluster-level ASN (no per-event data))\nInsufficient activity for classification \u00b7 Dominant: AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 Jurisdiction: US\n\u2192 Awaiting sufficient data\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 39.96\u00b0,-83.01\u00b0 US \u00b7 AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 34.57\u00b0,126.60\u00b0 KR \u00b7 AS4766 (Korea Telecom) [ISP] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ -4.58\u00b0,55.67\u00b0 SC \u00b7 AS198193 (Amarutu Technology Ltd) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 10.49\u00b0,-66.87\u00b0 VE \u00b7 AS272809 (THUNDERNET, C.A.) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ -6.82\u00b0,39.29\u00b0 TZ \u00b7 AS328436 (Flashnet-Technologies-Limited) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 51.30\u00b0,9.49\u00b0 DE \u00b7 AS8649 (Dedik Services Limited) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 7 nodes @ -33.87\u00b0,151.20\u00b0 AU \u00b7 AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 23 nodes @ -6.21\u00b0,106.84\u00b0 ID \u00b7 AS6389 (Amazon.com, Inc.) [Hyperscaler] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 43.72\u00b0,7.12\u00b0 FR \u00b7 AS3215 (Orange) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 9 nodes @ 34.77\u00b0,113.72\u00b0 CN \u00b7 AS4134 (CHINANET Guangdong province network) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 7 nodes @ 37.75\u00b0,-97.82\u00b0 US \u00b7 AS54641 (InMotion Hosting, Inc.) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 41.58\u00b0,-75.26\u00b0 US \u00b7 AS8010 (PenTeleData Inc.) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 9 nodes @ 53.34\u00b0,-6.26\u00b0 IE \u00b7 AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 50.45\u00b0,30.53\u00b0 UA \u00b7 AS214940 (Kprohost LLC) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 33.45\u00b0,-112.07\u00b0 US \u00b7 AS8075 (Microsoft Corporation) [Hyperscaler] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 29.42\u00b0,-98.49\u00b0 US \u00b7 AS8075 (Microsoft Corporation) [Hyperscaler] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 13 nodes @ 37.34\u00b0,-121.89\u00b0 US \u00b7 AS16509 (Amazon.com, Inc.) [Hyperscaler] \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 55.74\u00b0,37.61\u00b0 RU \u00b7 AS44050 (Petersburg Internet Network ltd.) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 40.25\u00b0,45.00\u00b0 AM \u00b7 AS197834 (Ucom CJSC) \u00b7 threat 50%\n[16:18:43]\u26abQuiet \u2014 3 nodes @ 16.17\u00b0,107.83\u00b0 VN \u00b7 AS2514 (GMO-Z.com Runsystem Joint Stock Company) \u00b7 threat 50%<\/code><\/pre>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":5606,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"class_list":["post-5885","page","type-page","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/pages\/5885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5885"}],"version-history":[{"count":3,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/pages\/5885\/revisions"}],"predecessor-version":[{"id":5892,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/pages\/5885\/revisions\/5892"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=\/wp\/v2\/media\/5606"}],"wp:attachment":[{"href":"https:\/\/neurosphere-2.tail52f848.ts.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}