{
    "generated": "2026-09-28T06:45:39+00:00",
    "events": [
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "89.248.165.74",
            "cc": "NL",
            "method": "GET",
            "path": "\/api\/v1\/registry",
            "tactic": "Endpoint discovery",
            "why": "Mapping which API paths exist by trying them in sequence.",
            "rule": "scan.enum",
            "score": 3,
            "is_you": false
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "200.68.14.55",
            "cc": "BR",
            "method": "GET",
            "path": "\/api\/v1\/registry\/42",
            "tactic": "Cross-tenant fetch",
            "why": "Requesting a record that belongs to another account.",
            "rule": "auth.cross",
            "score": 6,
            "is_you": false
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "5.188.206.14",
            "cc": "RU",
            "method": "GET",
            "path": "\/admin",
            "tactic": "Admin path probe",
            "why": "Checking for a management interface exposed by mistake.",
            "rule": "scan.admin",
            "score": 6,
            "is_you": false
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "172.104.11.99",
            "cc": "US",
            "method": "GET",
            "path": "\/api\/search?q=coffee",
            "tactic": "Normal traffic",
            "why": "A legitimate search request.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "200.68.14.55",
            "cc": "BR",
            "method": "GET",
            "path": "\/api\/v1\/registry\/42",
            "tactic": "Cross-tenant fetch",
            "why": "Requesting a record that belongs to another account.",
            "rule": "auth.cross",
            "score": 6,
            "is_you": false
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "103.145.13.11",
            "cc": "SG",
            "method": "GET",
            "path": "\/wp-admin",
            "tactic": "Scanner probe",
            "why": "Automated tool checking for admin panels that should not exist.",
            "rule": "scan.legacy",
            "score": 7,
            "is_you": false
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "45.155.205.233",
            "cc": "NL",
            "method": "GET",
            "path": "\/api\/search?q=' OR 1=1--",
            "tactic": "SQL injection",
            "why": "A tautology in the query tells the database to return every row.",
            "rule": "sql.tautology",
            "score": 8,
            "is_you": false
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "ip": "91.240.118.168",
            "cc": "UA",
            "method": "POST",
            "path": "\/upload",
            "tactic": "Webshell upload",
            "why": "Uploading an executable file that would run on the server.",
            "rule": "upload.webshell",
            "score": 12,
            "is_you": false
        }
    ],
    "wrapper": {
        "envelope": "B",
        "padding": 1024,
        "framing": "delimiter",
        "header_order": "shuffled",
        "rotations": 4,
        "last_rotate": 1790575294
    },
    "morph_log": [
        {
            "t": "02:30:39",
            "ts": 1790562639,
            "kind": "PREDICT",
            "label": "escalation from 198.98.51.189",
            "detail": "conf=0.90 \u00b7 4 recon probes, no exploit yet"
        },
        {
            "t": "02:30:39",
            "ts": 1790562639,
            "kind": "PREDICT",
            "label": "coordinated multi-region sweep",
            "detail": "conf=0.85 \u00b7 9 active source regions in window"
        },
        {
            "t": "02:30:39",
            "ts": 1790562639,
            "kind": "PREDICT",
            "label": "\/.git\/config",
            "detail": "conf=0.82 \u00b7 ladder from \/.env"
        },
        {
            "t": "02:30:39",
            "ts": 1790562639,
            "kind": "PREDICT",
            "label": "escalation from 156.146.45.91",
            "detail": "conf=0.75 \u00b7 2 recon probes, no exploit yet"
        },
        {
            "t": "02:30:39",
            "ts": 1790562639,
            "kind": "PREDICT",
            "label": "\/api\/v1\/registry\/129",
            "detail": "conf=0.74 \u00b7 sequential walk detected"
        },
        {
            "t": "02:30:39",
            "ts": 1790562639,
            "kind": "PREDICT",
            "label": "\/db.sql",
            "detail": "conf=0.72 \u00b7 ladder from \/backup.zip"
        },
        {
            "t": "02:34:49",
            "ts": 1790562889,
            "kind": "WRAPPER",
            "label": "env A \u2192 E",
            "detail": "pad=768 \u00b7 framing=delimiter \u00b7 hdr=shuffled"
        },
        {
            "t": "02:34:49",
            "ts": 1790562889,
            "kind": "PREDICT",
            "label": "coordinated multi-region sweep",
            "detail": "conf=0.80 \u00b7 5 active source regions in window"
        },
        {
            "t": "02:34:49",
            "ts": 1790562889,
            "kind": "PREDICT",
            "label": "\/db.sql",
            "detail": "conf=0.72 \u00b7 ladder from \/backup.zip"
        },
        {
            "t": "02:34:49",
            "ts": 1790562889,
            "kind": "PREDICT",
            "label": "\/.git\/config",
            "detail": "conf=0.58 \u00b7 ladder from \/backup.zip"
        },
        {
            "t": "02:35:54",
            "ts": 1790562954,
            "kind": "WRAPPER",
            "label": "env E \u2192 D",
            "detail": "pad=2048 \u00b7 framing=length-prefix \u00b7 hdr=reverse"
        },
        {
            "t": "02:35:54",
            "ts": 1790562954,
            "kind": "PREDICT",
            "label": "burst on \/login",
            "detail": "conf=0.90 \u00b7 4 POST attempts across 1 sources"
        },
        {
            "t": "02:35:54",
            "ts": 1790562954,
            "kind": "PREDICT",
            "label": "coordinated multi-region sweep",
            "detail": "conf=0.85 \u00b7 7 active source regions in window"
        },
        {
            "t": "02:35:54",
            "ts": 1790562954,
            "kind": "PREDICT",
            "label": "\/.git\/config",
            "detail": "conf=0.82 \u00b7 ladder from \/.env"
        },
        {
            "t": "02:35:54",
            "ts": 1790562954,
            "kind": "PREDICT",
            "label": "escalation from 89.248.165.74",
            "detail": "conf=0.75 \u00b7 2 recon probes, no exploit yet"
        },
        {
            "t": "02:35:54",
            "ts": 1790562954,
            "kind": "PREDICT",
            "label": "\/api\/v1\/registry\/129",
            "detail": "conf=0.74 \u00b7 sequential walk detected"
        },
        {
            "t": "02:35:54",
            "ts": 1790562954,
            "kind": "PREDICT",
            "label": "\/db.sql",
            "detail": "conf=0.72 \u00b7 ladder from \/backup.zip"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "WRAPPER",
            "label": "env D \u2192 C",
            "detail": "pad=1500 \u00b7 framing=chunked \u00b7 hdr=lexical"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "HIT",
            "label": "burst on \/login",
            "detail": "prediction confirmed \u00b7 conf was 0.90"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "PREDICT",
            "label": "coordinated multi-region sweep",
            "detail": "conf=0.85 \u00b7 9 active source regions in window"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "PREDICT",
            "label": "\/.git\/config",
            "detail": "conf=0.82 \u00b7 ladder from \/.env"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "PREDICT",
            "label": "burst on \/login",
            "detail": "conf=0.80 \u00b7 3 POST attempts across 2 sources"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "PREDICT",
            "label": "escalation from 156.146.45.91",
            "detail": "conf=0.75 \u00b7 2 recon probes, no exploit yet"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "PREDICT",
            "label": "\/api\/v1\/registry\/129",
            "detail": "conf=0.74 \u00b7 sequential walk detected"
        },
        {
            "t": "05:46:16",
            "ts": 1790574376,
            "kind": "PREDICT",
            "label": "\/db.sql",
            "detail": "conf=0.72 \u00b7 ladder from \/backup.zip"
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "kind": "WRAPPER",
            "label": "env C \u2192 B",
            "detail": "pad=1024 \u00b7 framing=delimiter \u00b7 hdr=shuffled"
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "kind": "PREDICT",
            "label": "coordinated multi-region sweep",
            "detail": "conf=0.80 \u00b7 5 active source regions in window"
        },
        {
            "t": "06:01:34",
            "ts": 1790575294,
            "kind": "PREDICT",
            "label": "escalation from 200.68.14.55",
            "detail": "conf=0.75 \u00b7 2 recon probes, no exploit yet"
        }
    ],
    "predictions": [
        {
            "label": "coordinated multi-region sweep",
            "confidence": 0.8,
            "reason": "5 active source regions in window",
            "kind": "region",
            "key": "coordinated",
            "made_at": 1790575294,
            "hit": false
        },
        {
            "label": "escalation from 200.68.14.55",
            "confidence": 0.75,
            "reason": "2 recon probes, no exploit yet",
            "kind": "source",
            "key": "200.68.14.55",
            "made_at": 1790575294,
            "hit": false
        }
    ],
    "pred_stats": {
        "made": 23,
        "hit": 1,
        "missed": 0
    }
}