Threat Watch · Live from Sherwood, OR

The internet never stops trying the door.

Every arc on this globe is a real connection that our firewall in Sherwood or the Cloudflare edge in front of cta-it.com just blocked. Real sources, real targets, replayed two minutes behind real time. Any business internet connection sees the same thing, all day, every day.

Connecting --:--:-- PT
Sensor 01 · Sherwood, OR
45.357° N  122.841° W
CTA Corporate HQ + Global Application Network
Last block, PT--:--:-- 
Blocked, last 15 min0Drag to rotate
24 hours
0
Connections blocked
24 hours
0
Different attacking hosts
24 hours
0
Countries of origin
24 hours
0
Web attacks stopped at the edge
Right now
 
Most probed service today
Blocked per hour, last 24 hours

It never stops

Hours shown in Pacific time.
Top origins, last 24 hours

Where it comes from

Origin is where the connection came from, which is often a rented server or hijacked device, not the attacker's home.
Most probed services, last 24 hours

What they knock on

None of these are open. Every attempt was dropped.
How Cascadia Technology Advisors helps

Everything on this page is stoppable.

We bring enterprise-grade security to businesses of 10 to 100 people: designed for your environment, deployed for you, and managed for you. We work with multiple leading security partners, so every business gets the right fit for its needs and budget, with the same platforms large companies rely on, a 24/7 security operations center behind them, and one local point of contact who knows your network.

01 · Keep them out
FW

Managed firewall

A business-grade firewall with intrusion prevention, botnet and reputation filtering, country blocking and VPN with multi-factor sign-in. We configure it, watch it, and patch its firmware fast when a firewall flaw lands on CISA's exploited list, which happens often. Moving or opening a location? We build it in from day one as part of an office move.

WAF

Web application firewall

Sits in front of your website and online apps at the edge of the internet, and filters attacks like the WordPress, injection and secret-hunting requests on this map before they ever reach your server. Includes DDoS protection and bot control.

ID

Identity and email security

Most breaches start with a stolen password or a phishing email. We lock down Microsoft 365 with multi-factor sign-in, conditional access and sign-in monitoring, filter phishing and malicious attachments, and train your team to spot what slips through.

VM

Vulnerability and patch management

Continuous scanning of every computer, server and network device for missing patches and risky settings, prioritized the way this page does it: by what attackers are actually exploiting right now, not just by severity scores.

02 · Catch what gets through
EDR

Endpoint Detection and Response

The modern replacement for antivirus. A lightweight agent on every PC and server watches what programs actually do, and catches attacker behavior like password theft, misuse of built-in Windows tools and ransomware starting to encrypt files, even when no signature exists yet. It can cut an infected machine off from the network in seconds.

NDR

Network Detection and Response

Watches the traffic moving inside your network, so it sees devices that cannot run an agent, like printers, cameras, phones and building systems. It spots an attacker moving from machine to machine, an infected device calling home to a botnet, or data quietly leaving the building.

XDR

Extended Detection and Response

Connects the dots across computers, network, email, Microsoft 365 sign-ins and cloud apps. A phishing email, a strange sign-in from overseas and an odd process on a laptop become one incident with one response, not three unrelated alerts nobody had time to read.

03 · Watch, respond, recover
SOC

24/7 SOC and SIEM

A SIEM collects and correlates the logs from your firewall, Microsoft 365, servers and computers. A SOC is the team of security analysts watching those alerts around the clock and acting on them, including at 2 a.m. on a Saturday, when ransomware usually runs. Delivered as a service, so you get a security operations center without staffing one.

AI

AI-assisted threat hunting

Machine learning learns what normal looks like for your people and devices, then surfaces the subtle signs that rules miss: impossible-travel sign-ins, unusual data access, slow and quiet beaconing. Analysts use it to hunt for attackers who are already inside, instead of waiting for an alarm.

BR

Backup and recovery

Immutable, protected backups of your servers and Microsoft 365, proven by actually restoring them on a schedule. When everything else fails, this is what turns ransomware from a business-ending event into a bad afternoon. Pairs with our server and migration work.

Not sure where to start? Most clients begin with a managed firewall, EDR and identity protection, then add 24/7 monitoring. A free security check shows exactly where you stand.

Book a free security check
CISA Known Exploited Vulnerabilities

Flaws attackers are using right now

When CISA adds a flaw to this catalog, it has confirmed evidence of real attacks. Federal agencies get a hard deadline to patch. A small business should treat the list the same way.

Loading catalog
New exploited vulnerabilities per month

The list keeps growing

The current month is partial.
Most-listed vendors this year

Software every office runs

Most recent additions

Patch-now list

Exploit likelihood = EPSS probability of attack in the next 30 days
AddedCVEProductExploit likelihoodWhy it matters
What this means for a 20-person office

Almost all of this is automated, and almost all of it fails. The goal is making sure yours always does.

Bots scan every internet connection around the clock, including your office and your home router. They look for a guessable password, an unpatched firewall or a remote desktop port someone forgot to close. Notice how many of the flaws above are in firewalls, VPNs and remote access tools. Those are the front doors.

Book a free security check
  1. 1
    Patch the edge firstFirewalls, VPNs and remote support tools get exploited within days of a flaw going public. They belong on your fastest update schedule.
  2. 2
    Turn on MFA everywhere it existsPassword guessing is constant. Multi-factor sign-in makes a correct guess useless.
  3. 3
    Close what you don't needNo remote desktop, file sharing or Telnet open to the internet. Put remote access behind a VPN or a zero-trust tunnel.
  4. 4
    Keep a backup attackers can't reachOffline or immutable, and restore-tested. It turns ransomware from a crisis into a bad afternoon.

Where the data comes from

  • Our WatchGuard firewall in Sherwood, OR (port scans, intrusion prevention, botnet, reputation and country blocks)
  • Cloudflare's edge in front of cta-it.com (blocked and challenged web requests)
  • CISA Known Exploited Vulnerabilities and FIRST EPSS

Privacy

No IP addresses are published or stored by this page, and nothing about the network being protected is shown. Events are summarized to country, service and threat type, and replayed about two minutes after they happen.

Why it matters

A small office network sees the same automated attacks as a large one. The difference is whether someone set up the defenses and keeps them current. That is what Cascadia Technology Advisors does, as part of ongoing IT support or a dedicated security engagement.