Honeypot activity, last 48 hours
—Collecting the hourly series…
New Web traffic is now classified alongside the honeypot
Live threat intelligence
Every attack on this lab becomes intelligence.
An SSH honeypot and web sensors catch what the internet throws at one home machine. A local pipeline enriches every address, links it into an intelligence graph of 690,000+ relationships, finds the campaigns behind the noise, feeds collective blocking — and turns the strongest cases into published dossiers.
10,781Unique attackers
638KLogin attempts
556KSSH sessions
55,028Commands captured
209Malware binaries
31,580IPs enriched
145Countries
65SSH campaigns
692KGraph links
915Tor exits seen
Refreshes every 15 minutes
How it works
From a stranger's login attempt to a published dossier.
Six stages run on their own, around the clock, on hardware in a Romanian home office. Nothing here waits for a vendor's cloud.
- 01Collect
A deliberately exposed SSH honeypot records every session, credential, command and download. Web sensors log every request that reaches the lab.
556K sessions - 02Enrich
Each new address is profiled from a dozen intelligence sources: reputation, ownership, open services, known vulnerabilities, Tor status.
21,120 deep-enriched - 03Link
A graph engine connects addresses that share SSH fingerprints, credentials, commands, keys, malware and infrastructure.
692K links - 04Attribute
Clusters of related behaviour become actors and campaigns, scored by threat and tracked across time.
65 SSH · 748 web - 05Defend
High-confidence findings flow into collective blocking at the edge, so the lab learns from every attempt.
48.9K IPs blocked - 06Publish
Local AI agents query the graph through hundreds of tools and draft evidence-backed dossiers a human reviews.
817 dossiers
Right now
The live picture, refreshed every fifteen minutes.
Everything below is rendered from the platform's public feed files. Attacker addresses are masked on this page; full indicators are available in the machine-readable feed.
Threat distribution
scored IPsScoring in progress…
Most recent attackers
masked- Waiting for the next session…
Where attacks come from
by IPCollecting…
Most active networks
attackers- Collecting…
Credential sprays
top pairs- Collecting…
Passwords are partly masked. They are what attackers tried — never real accounts.
What they do once "inside"
commands- Collecting…
Typical: wipe and replace SSH keys, lock the account, fingerprint the CPU, fetch a miner or a bot.
Enrichment coverage
—Collecting…
Deep enrichment sources
—- Collecting…
Intelligence linker
—- Waiting for the next linker run…
Campaigns
—- Collecting…
Malware drops
sha256- Collecting…
Attack tools identified
SSH fingerprints- Collecting…
Machine-readable feed: actor-clusters.json · licensed CC BY-NC-SA 4.0 with attribution.
Beyond SSH
The web side: who knocks, and what they want.
Every request that reaches the lab's public sites is logged, the sender profiled, and the intent classified — scrapers, watchers, credential harvesters, CMS probes, shell uploads, AI crawlers. Coordinated behaviour becomes a web campaign.
~1.01MHTTP requests logged
60,493IPs profiled
177Countries
748Web campaigns
3,295CVE correlations
242Also hit the honeypot
Probe intent
live · IPs per intentWho sends the traffic
as of 13 Oct 2026AI crawlers are now the single largest class of automated visitors — ahead of search engines.
Web campaigns
as of 13 Oct 2026748detected in total
236active in the last 30 days
110active in the last 7 days
- A fleet impersonating an AI assistant's user agent, spread over one cloud provider244 IPs
- Virtual-host sweep from a single hosting network99 IPs
- Temporal burst from a large hosting provider296 IPs
- Credential-harvest wave from a major cloud network127 IPs
Collective defense
Learning from every attempt — and sharing what it learns.
Findings don't stay in a database. They become blocking decisions at the edge of the network, merged with a community blocklist and curated threat feeds — and the lab's own indicator feed is published for anyone to use.
48,862IPs blocked
16.6MLog lines analysed
9,153Detection alerts
318Caught today
53,789 active blocking decisions right now, and 22,652 entries enforced at the router — shared with, and fed by, the wider community.
From the archive
When the graph saw it first: the Krane botnet.
Dossier TI-2026-013 documented a coordinated campaign: a Mirai-family Go SSH scanner, a persistent backdoor and a libssh scanner fleet, operating through a bulletproof-hosting ecosystem.
The intelligence graph separated three actor clusters, traced infrastructure to newly registered networks and documented the staging servers — before public attribution existed. A later attack on the lab was matched to this dossier and an earlier one automatically. It remains one of the clearest examples of what the platform is for.
32Confirmed IPs
16Countries
20Networks
8,854Login attempts
303Successful auths
55+Days active
Intelligence products
What comes out the other end.
Published, evidence-backed reports on actors, campaigns and infrastructure, each with a verification page. Drawn from 1,997 investigations and 4,156 tracked actors.
A machine-readable feed of actor clusters, high-value indicators, hostile networks, attack tools and malware samples — refreshed every quarter hour, free for non-commercial use with attribution.
Vectors across 26 collections — sessions, actors, evidence, a 700,389-entry exploit and CVE corpus — so agents find related cases by meaning, not keywords.
The engine room
One machine. Local models. No vendor in the loop.
Classification, enrichment triage and dossier drafting run on local language models behind a single router, on the same server that hosts everything else.
GPUAMD Radeon AI PRO R9700
32 GB VRAM, ROCm
Models7 served
Qwen3.5-9B (speculative decoding) to Qwen3.6-35B, behind one llama.cpp router
Agent tools445 MCP tools
plus 41 security-operations tools
Cluster156 pods
67 namespaces · 88 CPU threads · 503 GiB RAM
Work with the intelligence
Researcher, defender, or just curious?
Use the open feed, read the dossiers, or get in touch for deeper access to the graph and the tools behind it.