From my post above. I’m not really sure how useful this is. I was trying to see which servers had activity spikes compared to each other.
Updated highlighting server pair suggestions.
I like 85671 as my suspicious candidate, needing further analysis.
Are we just needing to analyse more forensically a single server?
LOOP16 from Reddit Thread says:
“Once you have identified a server that has been potentially compromised, it must be reported in the reddit thread with the number of the server and the suspicious element on the server.”
EDIT: This post has been updated 2018/07/06 02:45am so is similar in content as later posts by @Tezu It was kindly explained the numbers are variations of speed NOT an amount of data download. It remains useful I guess to have a colourful server comparison.