A live experiment
–
unsolicited connections to one small server
This server has nothing worth stealing and was never advertised. It gets found anyway. Everything that reaches it is recorded and published here, updated every 30 seconds.
Where it comes from
Each circle is a location, sized by traffic. Lines show sources active in the past hour.
Activity over time
All times are UTC. The two charts have separate scales because connections far outnumber what follows them.
Connection attempts per hour
First packets to any port except the website's
What happened after connecting, per hour
When they come
Connection attempts by weekday and hour
View hourly data as a table
What they try
Passwords come from decoys, including the SSH decoy on the standard port 22. Real SSH accepts only keys and runs on an unpublished port. A username or password appears only after two different hosts have tried it, so a one-off that could be someone's real secret stays private.
Usernames
Passwords
Username and password pairs
Most targeted ports
Web paths probed
What decoys received
Decoys targeted
SSH client software
Web client identities
What they do once inside
After several guesses, the SSH decoy lets a host into a fake shell. It's a table of canned replies: nothing runs, and nothing gets downloaded, stored, or followed. A download address appears in its list only after two different hosts have tried it, though it may also appear inside a session's commands.
Recent fake shell sessions
Commands in the order received. Activity from one host less than 5 minutes apart counts as one session, even over several logins. This text comes from attackers and is shown inert.
Fake shell activity
Where they try to download from
Recorded and never contacted. Addresses are defanged.
Who they are
Gathered without contacting them, from offline databases, reverse DNS, and public lists. Most sources are rented servers or hijacked devices, so a location says little about who is really behind them.
Countries
Networks
How concentrated it is
Likely operating system
A rough guess from each packet's TTL value.
What others know about them
Research scanners
Vulnerabilities listed by Shodan
Reported on the attacking hosts themselves. Listed, not verified.
Host groups
Hosts linked by the same password list, post-login commands, or download source. A group may be one operation, or just different people using the same tools and wordlists.
Host files
The most active sources. Select a row for its full record. An address here means traffic came from it, and its owner may be a victim too.
| Address | Network | Events |
|---|
Field notes
What stood out in the data, with a new note each morning.
How this works
Sensors. A firewall rule records the first packet of each unsolicited connection. It keeps headers only and blocks nothing. The server's real SSH logs add login attempts. Decoys for SSH, Telnet, FTP, databases, and other services log what they receive and always refuse logins, with one exception: after several guesses, the SSH decoy lets a host into a fake shell, which only replies from a fixed table. The firewall also stops the decoy service from starting any outbound connection. The website's request log picks out attacks, like requests for /.env.
What this site doesn't do. It never scans, probes, or responds to attacking hosts beyond a decoy's canned replies. Nothing an attacker sends is run, downloaded, or followed. Web addresses inside payloads are defanged.
Privacy. Reading this site is not logged as an event: requests that look like normal browsing become an anonymous count, and the raw web log is erased daily. There are no cookies, analytics, or third-party resources. The operator's addresses are excluded. Credentials seen from a single host are not published. Post-login commands are published as received, with web addresses defanged.
Limits. Source addresses can belong to compromised machines, VPNs, or research scanners, and locations are approximate. Counts are capped at 200 connections per second. A research scanner label requires a scanning company's network, a known domain in reverse DNS that resolves back to the address, or a client that names itself, which can be faked. The list of companies is partial. Unlabeled doesn't mean hostile. “Unrecognized logins” comes from this server's own logs, so it couldn't be trusted if an intruder ever gained full control of the machine.
Data. IP geolocation by DB-IP, licensed under CC BY 4.0. Host data from Shodan InternetDB, Spamhaus DROP, and the Tor exit list. Map from Natural Earth.