Today's Cyber Weather for Omaha
Ten live threat signals, measured against their own recorded history. Nothing here is estimated or generated — every number links back to the source that produced it.
Calm
Every signal that reported is at or below its normal level.
Recent readings
The signals behind today's reading
Each card shows the measurement, what it is compared against, and how many points it contributed.
Malicious scanning hosts seen worldwide (24h)
+0/2Most common behaviour: Web Crawler (51,976 hosts). (GreyNoise was rate-limited on this run — reusing its measurement from 6h ago.)
2 points if 25%+ above its own recent median, 1 point if 10%+ above.
GreyNoise sensor network (GNQL)Hosts hunting for exposed Remote Desktop (24h)
+0/26,632 malicious hosts probed port 3389 in the last 24 hours. Exposed RDP is still the most common ransomware entry point. (GreyNoise was rate-limited on this run — reusing its measurement from 6h ago.)
2 points if 25%+ above its own recent median, 1 point if 10%+ above.
GreyNoise sensor network (GNQL)Newly confirmed exploited vulnerabilities (7d)
+1/26 added in the last 7 days, none yet tied to ransomware.
2 points if CISA confirmed a newly exploited flaw is already used in ransomware, 1 point if there were new entries without a ransomware link.
CISA Known Exploited Vulnerabilities catalogRansomware victims published to leak sites (24h)
+0/229 organisations were named on ransomware leak sites in the last 24 hours — 10 of them in the United States. Most active gang: nightspire (12).
2 points if 25%+ above its own recent median, 1 point if 10%+ above.
ransomware.liveDays since the newest breach was published
+1/2Neogen — 435,963 accounts, published to HIBP today.
2 points if a breach of 1,000,000+ accounts was published in the last 3 days, 1 point if any breach was published in the last 7 days.
Have I Been PwnedNew malware command-and-control servers (24h)
+0/21,220 new control servers catalogued in 24 hours. Busiest malware family: Unknown Loader (345).
2 points if 25%+ above its own recent median, 1 point if 10%+ above.
abuse.ch ThreatFoxOmaha services running known-exploited software
+0/23,290 services in the Omaha metro are running software with publicly known vulnerabilities, and 105 expose Remote Desktop straight to the internet.
2 points if 10%+ above its own recent median, 1 point if 3%+ above.
Shodan host count APIShare of US web traffic that is automated (24h)
+0/254.7% of US web requests Cloudflare handled in the last 24 hours came from bots rather than people. Automated traffic is how attackers find exposed logins and unpatched software at scale.
2 points if 10%+ above its own recent median, 1 point if 3%+ above.
Cloudflare RadarShare of global web attacks aimed at US targets (24h)
+0/251.8% of the web application attacks Cloudflare mitigated in the last 24 hours were aimed at targets in the United States — rank 1 worldwide.
2 points if 10%+ above its own recent median, 1 point if 3%+ above.
Cloudflare Radar (layer-7 attacks)Hosts probing the most-targeted ports today
+0/251,577 distinct hosts were caught probing the ten most-targeted ports today. Busiest target: port 80 (7,082 hosts).
2 points if 25%+ above its own recent median, 1 point if 10%+ above.
SANS Internet Storm Center (DShield sensors)Omaha, Exposed Right Now
What is reachable from the public internet in our own city, counted by Shodan at the time of the reading.
Counts internet-visible services attributed to Omaha by Shodan. One business can account for several services, and a listing is exposure — not proof of compromise.