One home lab. Every attacker it traps gets blocked far beyond it.
This machine is attacked all day, every day. It records each attempt, blocks the source at the edge — and shares the verdict, so the same attacker is stopped elsewhere too.
One machine · Xeon · 88 threads · 503 GiB RAM · AMD Radeon AI PRO R9700 · built and run by one engineer near Iași, Romania
Refreshes every 15 minutes
An attacker finds what looks like an easy server. Here is what happens next.
Every step below runs on its own, around the clock. The attacker sees a weak target; what they actually touched is a trap wired to a network of defenders.
- A "vulnerable" SSH server is discovered
Mass scanners sweep the internet for open logins. This one answers like a real, slightly neglected Linux box.
attacker's view - The honeypot plays along
A high-interaction honeypot gives them a convincing shell, a believable file system and fake services. They think they are in.
317 caught in the last 24 h - Everything is recorded
Every username and password tried, every command typed, every file downloaded — kept for analysis and replay.
638K login attempts so far - Web attacks are recognised too
In parallel, a behavioural detection engine reads every web request: exploit attempts, brute force, CMS scanners, path traversal — classified and scored.
60.5K web addresses profiled - Blocked at the edge
The verdict is pushed straight to the router. The address is dropped at the network edge before it can reach any real service.
22,652 edge blocks active now - The operator is told — on the phone
Real-time alerts carry the attack type, the origin and the response, wherever the operator happens to be.
real-time alerts - Shared — and burned everywhere
The verdict goes to a community network of defenders. Members stop this address before it ever reaches them. One trap here, protection for strangers elsewhere.
18.9K verdicts received back - It feeds the intelligence platform
Sessions flow into dashboards and the threat-intelligence pipeline: enrichment, campaign detection and, for the strongest cases, published dossiers.
817 dossiers published - Repeat offenders don't get a second chance
Bans escalate for addresses that come back. The system remembers, and each return costs the attacker more.
escalating bans
Not estimates. Counts from production, right now.
Every figure on this page is read from the lab's own systems and republished every fifteen minutes.
trapHoneypot
shareCommunity
blockActive defense
webWeb sensors
What is hitting the lab, by kind of attack.
Recent web detections, classified and counted. A quiet category is good news — the detector is still watching for it.
The bulletproof glass building.
Picture a fully transparent office building on a busy street. Floor-to-ceiling glass. Anyone can look in, and it looks inviting — maybe even vulnerable.
But the glass is bulletproof, and the offices behind it are screens playing a convincing fake. The real work happens in a bunker underneath.
That is what attackers see here. The honeypot is the screen. The detection engine is the camera. The edge firewall is the glass.
And every recording is shared. The attackers aren't just failing here — they are making every other target harder to attack.
What scanners are looking for, right now.
Two honest windows into the bots' playbook: the web paths they try on this site, and the subdomains they guess exist. Nothing filtered for drama.
Paths probed on this site
404s- Collecting…
Config files, version-control folders and CMS admin pages — on a site that runs no CMS at all.
Subdomains guessed
recon- Collecting…
Names that don't exist here. Each one is a scanner's dictionary entry — a glimpse of what attackers expect a lab like this to run.
Reconnaissance gets an answer — a block, in seconds.
Scanners and sensor networks probe the lab constantly to fingerprint what runs here. The latest verdicts, as they happened — detected, classified, blocked and reported without anyone touching a keyboard.
Latest detections
masked- Collecting…
Addresses are masked on this page. The full indicators are part of the live feed.
How a probe is handled
automatic- Request reaches the edgeT+0
- Pattern recognised and scoredseconds
- Address dropped at the routerseconds
- Operator alertedreal time
- Verdict shared with the communityminutes
The lab collects passively and defends itself. Any follow-up look at an attacker is limited, read-only, and only for addresses that attacked first — see the disclaimer.
Every layer, from the internet to the kernel.
Each layer works on its own. If one fails, the others still protect — and nothing reaches the real services unchecked.
The router drops known-bad addresses before they even reach the server, and receives new bans automatically.
TLS everywhere, rate limits, strict security headers, and a log line for every request.
Reads every request, recognises attack patterns and issues verdicts — shared with the community both ways.
Every private service sits behind one login with multi-factor authentication and per-service access rules.
160 services across 67 namespaces, with runtime security watching system calls for anything unusual.
The honeypot
An exposed SSH login leads only to the honeypot. Its sessions stream into dashboards and the intelligence pipeline — never near a real service.
Host and router
Verdicts are enforced twice: on the host's own firewall and at the network edge — so a block holds even if one layer is restarted.
A phone in a pocket
Detections and bans reach the operator in real time, with context, so a human can step in whenever it matters.
One engineer, an AI pair, and a lot of 2 AM debugging.
The honeypot, the detection-to-router integration, the dashboards and this page were designed, built and debugged with Claude Code as the engineering partner — from container manifests to escalation logic. The same lab runs its own local agent, lsn-agent-v3.
- Live threat feedevery 15 min
- Honeypot reportlive
- Published dossiers817
- The intelligence platformstory