BoarNet · Research
Weekly threat-intelligence reports
Every Monday we publish what the BoarNet sensor fleet caught the week prior — edge-device scanning trends, novel attacker IPs, dropper payloads, and probe-family breakdowns. Aggregate-only; per-IP detail lives in the dashboard for authenticated researchers.
- Week of 2026-06-29
Week of 2026-06-29: SYN-only flood dominates at 80.8% of 200 K events; DigitalOcean single-AS concentration reaches 81%
- 200.0k
- events captured
- 973
- distinct IPs
- 1.4k
- novel attackers
- 4
- samples collected
- Week of 2026-06-22
Weekly report
- 200.0k
- events captured
- 990
- distinct IPs
- 1.2k
- novel attackers
- 103
- samples collected
- Week of 2026-06-15
Weekly report
- 200.0k
- events captured
- 1.1k
- distinct IPs
- 1.6k
- novel attackers
- 86
- samples collected
- Week of 2026-06-08
Week of 2026-06-08: SYN-only flood dominates at 82.8% of total events; DigitalOcean concentration drives US-origin skew
- 200.0k
- events captured
- 931
- distinct IPs
- 3.2k
- novel attackers
- 97
- samples collected
- Week of 2026-06-01
Week of 2026-06-01: SYN-sink traffic dominates at 96 K events; DigitalOcean concentration drives nearly half of total volume
- 200.0k
- events captured
- 2.1k
- distinct IPs
- 17.7k
- novel attackers
- 120
- samples collected
- Week of 2026-04-27
Week of 2026-04-27: SYN-only flood dominates at 96.3% of 200k events; infrastructure ASNs drive high-volume, low-IP density probing
- 200.0k
- events captured
- 1.0k
- distinct IPs
- 2.6k
- novel attackers
- 15
- samples collected
- Week of 2026-04-20
Week of 2026-04-20: High-volume concentrated scanning from VPS infrastructure dominates quiet week
- 52.1k
- events captured
- 1.3k
- distinct IPs
- 1.1k
- novel attackers
- 0
- samples collected