Live · last 24 hours
attacks.
This is a real, isolated honeypot: a decoy system with nothing of value on it, built to be attacked. Every arc is an actual intrusion attempt, captured as it happens.
// attempts
401,738
Intrusion attempts in the last 24 hours
// attackers
6,860
Unique IP addresses behind them
// countries
104
Countries those addresses trace to
// Where it comes from
Top origins.
// Right now
Latest hits.
- 54s agoBangladeshport 5060180.149.232.x
- 55s agoGermanyport 4754435.207.72.x
- 55s agoTanzaniaport 41.59.200.x
- 56s agoGermanyport 4754035.207.72.x
- 57s agoTanzaniaport 41.59.200.x
- 59s agoTanzaniaport 41.59.200.x
// Which decoy caught them
// What this means for you
Nobody is too small to target.
It's automated
None of this is personal. Bots scan every address on the internet, all day, looking for anything left open.
Location is noise
Attackers rent servers anywhere. A country on this map is where the machine is, not who is behind it.
Most of it is guessing
Default passwords, old software, forgotten remote access. The basics stop the vast majority of it.
Nothing real is exposed
The honeypot is walled off from everything else. It exists to be hit, so I can see what's out there.
// Let's talk
Want to know what's hitting your network?
Send me a message. I'll tell you what I see in plain English and you decide what's next.
Start a conversation