{
    "generated": "2026-09-28T07:30:12+00:00",
    "events": [
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "156.146.45.91",
            "cc": "FR",
            "method": "GET",
            "path": "\/api\/v1\/registry\/1",
            "tactic": "Sequential ID probe",
            "why": "Walking through record IDs to enumerate the registry.",
            "rule": "auth.enum",
            "score": 5,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "3.120.44.18",
            "cc": "IE",
            "method": "GET",
            "path": "\/api\/v1\/registry\/128",
            "tactic": "Normal traffic",
            "why": "A legitimate record fetch.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "3.120.44.18",
            "cc": "IE",
            "method": "GET",
            "path": "\/api\/v1\/registry\/128",
            "tactic": "Normal traffic",
            "why": "A legitimate record fetch.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "3.120.44.18",
            "cc": "IE",
            "method": "GET",
            "path": "\/api\/v1\/registry\/128",
            "tactic": "Normal traffic",
            "why": "A legitimate record fetch.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "3.120.44.18",
            "cc": "IE",
            "method": "GET",
            "path": "\/api\/v1\/registry\/128",
            "tactic": "Normal traffic",
            "why": "A legitimate record fetch.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "198.98.51.189",
            "cc": "CA",
            "method": "POST",
            "path": "\/register",
            "tactic": "Automated signup",
            "why": "Bulk account creation, often a precursor to abuse.",
            "rule": "auth.automated",
            "score": 4,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "141.98.10.110",
            "cc": "SE",
            "method": "GET",
            "path": "\/backup.zip",
            "tactic": "Backup file probe",
            "why": "Looking for a forgotten backup archive that would leak the whole database.",
            "rule": "scan.backup",
            "score": 11,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "185.7.214.7",
            "cc": "IR",
            "method": "POST",
            "path": "\/login",
            "tactic": "Brute force",
            "why": "Hundreds of password guesses per minute against one account.",
            "rule": "auth.brute",
            "score": 10,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "3.120.44.18",
            "cc": "IE",
            "method": "GET",
            "path": "\/api\/v1\/registry\/128",
            "tactic": "Normal traffic",
            "why": "A legitimate record fetch.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "141.98.10.110",
            "cc": "SE",
            "method": "GET",
            "path": "\/backup.zip",
            "tactic": "Backup file probe",
            "why": "Looking for a forgotten backup archive that would leak the whole database.",
            "rule": "scan.backup",
            "score": 11,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "194.26.135.87",
            "cc": "DE",
            "method": "GET",
            "path": "\/.env",
            "tactic": "Secret file probe",
            "why": "Looking for a leaked environment file with API keys and passwords.",
            "rule": "scan.secret",
            "score": 9,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "172.104.11.99",
            "cc": "US",
            "method": "GET",
            "path": "\/api\/search?q=coffee",
            "tactic": "Normal traffic",
            "why": "A legitimate search request.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "185.220.101.42",
            "cc": "RU",
            "method": "POST",
            "path": "\/login",
            "tactic": "Credential stuffing",
            "why": "Reusing leaked username\/password pairs against the login form.",
            "rule": "auth.repeat",
            "score": 5,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "103.145.13.11",
            "cc": "SG",
            "method": "GET",
            "path": "\/wp-admin",
            "tactic": "Scanner probe",
            "why": "Automated tool checking for admin panels that should not exist.",
            "rule": "scan.legacy",
            "score": 7,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "156.146.45.91",
            "cc": "FR",
            "method": "GET",
            "path": "\/api\/v1\/registry\/1",
            "tactic": "Sequential ID probe",
            "why": "Walking through record IDs to enumerate the registry.",
            "rule": "auth.enum",
            "score": 5,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "185.7.214.7",
            "cc": "IR",
            "method": "POST",
            "path": "\/login",
            "tactic": "Brute force",
            "why": "Hundreds of password guesses per minute against one account.",
            "rule": "auth.brute",
            "score": 10,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "185.220.101.42",
            "cc": "RU",
            "method": "POST",
            "path": "\/login",
            "tactic": "Credential stuffing",
            "why": "Reusing leaked username\/password pairs against the login form.",
            "rule": "auth.repeat",
            "score": 5,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "198.98.51.189",
            "cc": "CA",
            "method": "POST",
            "path": "\/register",
            "tactic": "Automated signup",
            "why": "Bulk account creation, often a precursor to abuse.",
            "rule": "auth.automated",
            "score": 4,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "172.104.11.99",
            "cc": "US",
            "method": "GET",
            "path": "\/api\/search?q=coffee",
            "tactic": "Normal traffic",
            "why": "A legitimate search request.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "172.104.11.99",
            "cc": "US",
            "method": "GET",
            "path": "\/api\/search?q=coffee",
            "tactic": "Normal traffic",
            "why": "A legitimate search request.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "3.120.44.18",
            "cc": "IE",
            "method": "GET",
            "path": "\/api\/v1\/registry\/128",
            "tactic": "Normal traffic",
            "why": "A legitimate record fetch.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "89.248.165.74",
            "cc": "NL",
            "method": "GET",
            "path": "\/api\/v1\/registry",
            "tactic": "Endpoint discovery",
            "why": "Mapping which API paths exist by trying them in sequence.",
            "rule": "scan.enum",
            "score": 3,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "3.120.44.18",
            "cc": "IE",
            "method": "GET",
            "path": "\/api\/v1\/registry\/128",
            "tactic": "Normal traffic",
            "why": "A legitimate record fetch.",
            "rule": "",
            "score": 0,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "198.98.51.189",
            "cc": "CA",
            "method": "POST",
            "path": "\/register",
            "tactic": "Automated signup",
            "why": "Bulk account creation, often a precursor to abuse.",
            "rule": "auth.automated",
            "score": 4,
            "is_you": false
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "ip": "185.7.214.7",
            "cc": "IR",
            "method": "POST",
            "path": "\/login",
            "tactic": "Brute force",
            "why": "Hundreds of password guesses per minute against one account.",
            "rule": "auth.brute",
            "score": 10,
            "is_you": false
        }
    ],
    "wrapper": {
        "envelope": "A",
        "padding": 512,
        "framing": "length-prefix",
        "header_order": "canonical",
        "rotations": 0,
        "last_rotate": 1790578080
    },
    "morph_log": [
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "kind": "PREDICT",
            "label": "burst on \/login",
            "detail": "conf=0.92 \u00b7 5 POST attempts across 2 sources"
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "kind": "PREDICT",
            "label": "coordinated multi-region sweep",
            "detail": "conf=0.85 \u00b7 7 active source regions in window"
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "kind": "PREDICT",
            "label": "\/.git\/config",
            "detail": "conf=0.82 \u00b7 ladder from \/.env"
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "kind": "PREDICT",
            "label": "escalation from 156.146.45.91",
            "detail": "conf=0.75 \u00b7 2 recon probes, no exploit yet"
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "kind": "PREDICT",
            "label": "\/api\/v1\/registry\/129",
            "detail": "conf=0.74 \u00b7 sequential walk detected"
        },
        {
            "t": "06:48:00",
            "ts": 1790578080,
            "kind": "PREDICT",
            "label": "\/db.sql",
            "detail": "conf=0.72 \u00b7 ladder from \/backup.zip"
        }
    ],
    "predictions": [
        {
            "label": "burst on \/login",
            "confidence": 0.92,
            "reason": "5 POST attempts across 2 sources",
            "kind": "path",
            "key": "\/login",
            "made_at": 1790578080,
            "hit": false
        },
        {
            "label": "coordinated multi-region sweep",
            "confidence": 0.85,
            "reason": "7 active source regions in window",
            "kind": "region",
            "key": "coordinated",
            "made_at": 1790578080,
            "hit": false
        },
        {
            "label": "\/.git\/config",
            "confidence": 0.82,
            "reason": "ladder from \/.env",
            "kind": "path",
            "key": "\/.git\/config",
            "made_at": 1790578080,
            "hit": false
        },
        {
            "label": "escalation from 156.146.45.91",
            "confidence": 0.75,
            "reason": "2 recon probes, no exploit yet",
            "kind": "source",
            "key": "156.146.45.91",
            "made_at": 1790578080,
            "hit": false
        },
        {
            "label": "\/api\/v1\/registry\/129",
            "confidence": 0.74,
            "reason": "sequential walk detected",
            "kind": "path",
            "key": "\/api\/v1\/registry\/129",
            "made_at": 1790578080,
            "hit": false
        },
        {
            "label": "\/db.sql",
            "confidence": 0.72,
            "reason": "ladder from \/backup.zip",
            "kind": "path",
            "key": "\/db.sql",
            "made_at": 1790578080,
            "hit": false
        }
    ],
    "pred_stats": {
        "made": 6,
        "hit": 0,
        "missed": 0
    }
}