PANOTECH Consulting & Services Group

Science · Technology · Common Sense

Cyber Vitals

A plain-language read on current internet threat conditions — rebuilt every hour, with every source and its age shown on its face.

An instrument, not an advertisement. Every reading shows where it came from and how old it is, the page runs no JavaScript, and nothing here is for sale.

Conditions

Internet threat level

  1. GREEN
  2. YELLOW
  3. ORANGE
  4. RED

20 days at this level

SANS Internet Storm Center · current level · checked hourly · read just now · live

8.8%

of global email is malicious

Cloudflare Radar · 7-day · checked hourly · read just now · live

133,241

malicious IPs tracked

IPsum · 24h · checked daily · read 22h ago · live

For leadership

What this costs

88.7%

of malicious email impersonates a trusted brand or contact

Cloudflare Radar · 7-day · checked every 6 hours · read 2h ago · live

$2.77B

reported business email compromise losses in 2024

FBI IC3 2024 Internet Crime Report · as of 2025-04

299 ▲

ransomware victim claims posted this week

RansomLook · 7-day · checked every 6 hours · read 1h ago · live

Ransomware figures count unverified breach claims posted to leak sites; individual victim names are never published — a claim is not a confirmation.

What to ask your team

  • Brand impersonation Do we publish DMARC, and is it set to reject or only to monitor?
  • Payment fraud When a supplier asks us to change their bank details, how do we verify that request through a channel we already had?
  • Ransomware When did we last restore from a backup, rather than confirm that one exists?

Questions, not recommendations — Panotech sells nothing and takes no vendor commissions. Each one is answerable inside your own organisation.

For IT

Patch these first

  1. 01 Google Chromium CVE-2026-125350 added 3d ago
  2. 02 Barracuda Networks Barracuda Email Security Gateway (ESG) CVE-2026-116606 added 3d ago
  3. 03 Barracuda Networks Multiple Products CVE-2026-111560 added 3d ago
  4. 04 Cisco BroadWorks CVE-2026-20320 added 3d ago
  5. 05 Openwave Messaging Limited Webtop Media Transcoder CVE-2026-111793 added 3d ago

Software with vulnerabilities under active exploitation, newest first. If it's on this list and in your stack, patch it before anything else.

CISA KEV Catalog · 45-day window · checked every 6 hours · read just now · live

Email authentication adoption

  1. DMARC 89%
  2. SPF 80.3%
  3. DKIM 89.4%

Share of observed email passing each authentication check — higher adoption makes sender spoofing harder for everyone.

Cloudflare Radar · 7-day · checked daily · read 23h ago · live

Where brute force is hitting

  1. Email (SMTP) 13,441
  2. Web servers 10,032
  3. SSH logins 4,483
  4. Email (IMAP) 4,268
  5. Website logins 837

25,993 unique attacking IPs across all services in the last 48 hours — reported by the victims' own servers, an independent measure from the aggregated IPsum count above. Services overlap, so their figures are never summed.

Blocklist.de · 48h window · checked twice daily · read 22h ago · live

Latest CISA advisories

8

advisories published by CISA in the last 7 days

Newest: Siemens Desigo, Gridscale (12 Nov 2026).

CISA Cybersecurity Advisories · 7-day window · checked twice daily · read 8h ago · live

For everyone

What to watch for

22.4%

of login attempts screened by Cloudflare used a password already leaked in a breach — reusing one password exposes every account that shares it

Cloudflare Radar · 7-day · checked twice daily · read 8h ago · live

939 ▼

suspected phishing sites currently flagged as active

phishunt.io · live list · checked every 6 hours · read just now · live

Phishing figures count sites flagged by automated heuristics — suspicion, not verified findings; a suspected site is not a confirmed one.

If you remember one thing today

If a call, text, or email urges you to act right now, stop. Contact the organisation through a channel you found yourself, never the one inside the message.

Panotech Sensor Network

What our own sensors saw

Most of this is automated scanning — scripts sweeping the entire internet for common software, not an attack aimed at anyone in particular. It is the background noise every internet-connected business receives.

5,016

attacks observed in the last 7 days

978

unique sources in the last 7 days

Prior 7-day window: 3,790 attacks from 1,165 sources — attack volume is up 32% week-over-week; the number of sources is down 16%. Attacks per source rose from 3.3 to 5.1 — narrower, deeper scanning: fewer machines, each doing more.

Top attacking networks

Top attacking networks over the window
NetworkAttacks SourcesPer IP
DigitalOcean, LLC 2,675 38 70.4▲
Digital Ocean, Inc. 279 1 279▲
Microsoft Corporation 151 16 9.4
VPN-Consumer-US 146 55 2.7
VPN Consumer Dallas, United States of America 112 43 2.6
Oracle Corporation 101 3 33.7▲
SpaceX Services, Inc. 101 3 33.7▲
Google LLC 90 8 11.3▲
VPN Consumer Washington DC, United States 71 28 2.5
VPN Consumer Tampa, United States of America 70 39 1.8

▲ High attacks-per-source indicates dedicated attack infrastructure rather than compromised cloud hosts.

Attack categories

  1. WordPress Login Probe 1,262
  2. Laravel Env Probe 949
  3. phpMyAdmin Probe 591
  4. Git Config Probe 547
  5. Webshell Recon 490
  6. Web App Probe 376
  7. PHP Eval Probe 323
  8. API User Enum 81
  9. GraphQL Probe 76
  10. Spring Boot Actuator 76
  11. Confluence Exploit 63
  12. Exchange Exploit 56
  13. API Schema Probe 44
  14. React RSC Exploit 31
  15. Other 51

Countries of origin

  1. India 2,278
  2. United States 916
  3. Australia 295
  4. United Kingdom 186
  5. Netherlands 170
  6. Germany 153
  7. Singapore 150
  8. France 106
  9. Nigeria 99
  10. Belgium 75
  11. United Arab Emirates 49
  12. Ukraine 44
  13. Canada 41
  14. Mexico 38
  15. Other 416

ATT&CK techniques observed

The same attacks, grouped by what the attacker was trying to achieve — in MITRE ATT&CK® terms, the shared vocabulary IT teams use to compare notes across vendors.

  1. Password guessing T1110.001 1,853
  2. Credentials in files T1552.001 1,587
  3. Vulnerability scanning T1595.002 577
  4. Exploiting public-facing apps T1190 503
  5. Active scanning T1595.003 490
  6. Other 6

Attacks by hour of day (UTC)

00:00–00:59 UTC · 290 attacks01:00–01:59 UTC · 186 attacks02:00–02:59 UTC · 177 attacks03:00–03:59 UTC · 305 attacks04:00–04:59 UTC · 211 attacks05:00–05:59 UTC · 170 attacks06:00–06:59 UTC · 154 attacks07:00–07:59 UTC · 231 attacks08:00–08:59 UTC · 173 attacks09:00–09:59 UTC · 161 attacks10:00–10:59 UTC · 185 attacks11:00–11:59 UTC · 188 attacks12:00–12:59 UTC · 100 attacks13:00–13:59 UTC · 186 attacks14:00–14:59 UTC · 195 attacks15:00–15:59 UTC · 268 attacks16:00–16:59 UTC · 166 attacks17:00–17:59 UTC · 155 attacks18:00–18:59 UTC · 161 attacks19:00–19:59 UTC · 218 attacks20:00–20:59 UTC · 217 attacks21:00–21:59 UTC · 436 attacks43622:00–22:59 UTC · 306 attacks23:00–23:59 UTC · 177 attacks

Benign crawlers are excluded from every figure above. Attacker-reported tooling is not shown; it is forgeable. Counts under 5 are withheld — precision aids sensor fingerprinting. Aggregates are free to reuse with attribution for non-commercial purposes (CC BY-NC 4.0).

Panotech Sensor Network · 7-day window · checked every 2 hours · read 1h ago · live