Live traffic hitting a real, internet-exposed honeypot — unsolicited scans, brute-force logins, and malware drop attempts, as they happen. No production systems are involved; every connection below is unsolicited and targets a monitored research sensor. See methodology.
Attacker IPs churn (most are seen once or twice), but the tooling behind them is stable. Sessions are grouped by what they actually do: the commands they run, the SSH client they use, or the web paths they probe. Last 7 days; "since" dates reach back to August for SSH and mid-October for telnet and web, the oldest raw logs available.
| loading… |
Scanners hunt for exposed Model Context Protocol servers (the tool interface AI agents use). The sensor answers as a fake "internal ops tools" server; nothing it returns is real and no tool ever runs.
Emulated Redis, Docker API, Elasticsearch, Android Debug Bridge, MySQL, VNC and MSSQL listeners. They speak just enough protocol to record what an attacker tries; nothing is executed.
Aggregated from the last 7 days of sensor traffic. Full real-time per-IP data is available via the API feed.