Author here :)

TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

Sharing a small tool I built for triaging Linux command telemetry.

malscore scores a command or a whole shell session (history/auditd/EDR feed) from 0–100 with a verdict band and the ATT&CK techniques behind it. It's static and never executes the input; ~113 named signals fire and combine via noisy-OR, so every point traces to a reason. Session mode adds cross-command detections (stage→exfil, download-then-run, escalation→cred access, log/history clearing).

pip install malscore

GitHub: https://github.com/raj3shp/malscore · zero deps. Feedback welcome.

For phishing and lookalike-domain monitoring: wss://api.certstream.dev/ streams domain names of newly issued certificates. Python example on certstream.dev/free-certstream-api.html. Open source, you can self-host.