Below are the latest honeypot stats from SparTech Software’s in-house honeypot.

SparTech Software Honeypot Project

23,383Events recorded
301Today
1,857Distinct sources
12,581Attacks on login or upload
353Hands-on intrusions
9Enumeration sweeps

Event volume by severity

Last 14 days. Tall pale bars are ordinary background scanning; dark segments are attempts that carried credentials or a payload.

  • Recon (sev 1-2)
  • Loot hunting (sev 3)
  • Attack (sev 4-5)
  • Critical (sev 6)
015030019 Oct — Recon (sev 1-2): 9719 Oct — Loot hunting (sev 3): 119 Oct — Attack (sev 4-5): 10920719 Oct20 Oct — Recon (sev 1-2): 6520 Oct — Attack (sev 4-5): 5512020 Oct21 Oct — Recon (sev 1-2): 9721 Oct — Loot hunting (sev 3): 121 Oct — Attack (sev 4-5): 8218021 Oct22 Oct — Recon (sev 1-2): 8222 Oct — Loot hunting (sev 3): 122 Oct — Attack (sev 4-5): 5113422 Oct23 Oct — Recon (sev 1-2): 6223 Oct — Attack (sev 4-5): 5411623 Oct24 Oct — Recon (sev 1-2): 5424 Oct — Attack (sev 4-5): 5210624 Oct25 Oct — Recon (sev 1-2): 5725 Oct — Attack (sev 4-5): 5411125 Oct26 Oct — Recon (sev 1-2): 5426 Oct — Attack (sev 4-5): 9014426 Oct27 Oct — Recon (sev 1-2): 11727 Oct — Loot hunting (sev 3): 627 Oct — Attack (sev 4-5): 5117427 Oct28 Oct — Recon (sev 1-2): 5728 Oct — Attack (sev 4-5): 4710428 Oct29 Oct — Recon (sev 1-2): 5829 Oct — Loot hunting (sev 3): 129 Oct — Attack (sev 4-5): 4910929 Oct30 Oct — Recon (sev 1-2): 8030 Oct — Attack (sev 4-5): 5813830 Oct31 Oct — Recon (sev 1-2): 5131 Oct — Attack (sev 4-5): 449531 Oct1 Nov — Recon (sev 1-2): 1421 Nov — Loot hunting (sev 3): 31 Nov — Attack (sev 4-5): 1132961 Nov
Show data table
DayRecon (sev 1-2)Loot hunting (sev 3)Attack (sev 4-5)Total
19 Oct971109207
20 Oct65055120
21 Oct97182180
22 Oct82151134
23 Oct62054116
24 Oct54052106
25 Oct57054111
26 Oct54090144
27 Oct117651174
28 Oct57047104
29 Oct58149109
30 Oct80058138
31 Oct5104495
1 Nov1423113296

Severity mix

The scale measures engagement depth. 1-2 is recon, 3 is hunting for loot, 4 is an exploit being attempted, 5 is an attack on the login or upload surface, and 6 means somebody acted on what they took.

Severity 1, Informational — 4,917 events (21%)Severity 2, Targeted recon — 2,102 events (9%)Severity 3, Loot hunting — 139 events (1%)Severity 4, Exploitation attempt — 3,644 events (16%)Severity 5, Credential or upload attack — 12,228 events (52%)Severity 6, Critical — hands-on — 353 events (2%)23,383eventsInformational4,917 · 21%Targeted recon2,102 · 9%Loot hunting139 · 1%Exploitation attempt3,644 · 16%Credential or upload attack12,228 · 52%Critical — hands-on353 · 2%
Show data table
SeverityLevelEventsShare
1Informational4,91721%
2Targeted recon2,1029%
3Loot hunting1391%
4Exploitation attempt3,64416%
5Credential or upload attack12,22852%
6Critical — hands-on3532%

Activity by hour of day

Flat coverage across all 24 hours is the signature of automation. Humans cluster into working hours, and the shaded band is the stretch nobody is choosing to work through.

  • Daytime and evening
  • Small hours (00:00-05:59)
01,2502,50000:00-00:59 — 2,302 events0001:00-01:59 — 899 events02:00-02:59 — 1,494 events03:00-03:59 — 967 events0304:00-04:59 — 901 events05:00-05:59 — 1,372 events06:00-06:59 — 1,089 events0607:00-07:59 — 1,163 events08:00-08:59 — 883 events09:00-09:59 — 1,089 events0910:00-10:59 — 1,047 events11:00-11:59 — 939 events12:00-12:59 — 760 events1213:00-13:59 — 596 events14:00-14:59 — 665 events15:00-15:59 — 536 events1516:00-16:59 — 1,103 events17:00-17:59 — 788 events18:00-18:59 — 472 events1819:00-19:59 — 671 events20:00-20:59 — 586 events21:00-21:59 — 678 events2122:00-22:59 — 874 events23:00-23:59 — 1,509 events
Show data table
HourEvents
00:002,302
01:00899
02:001,494
03:00967
04:00901
05:001,372
06:001,089
07:001,163
08:00883
09:001,089
10:001,047
11:00939
12:00760
13:00596
14:00665
15:00536
16:001,103
17:00788
18:00472
19:00671
20:00586
21:00678
22:00874
23:001,509

Top event types

What the honeypot caught people doing, counted over everything it has recorded.

xmlrpc_credentialsxmlrpc_credentials — 11,74311,743not_found_scannot_found_scan — 4,3354,335security_probesecurity_probe — 3,3893,389bait_pathbait_path — 2,8002,800login_attemptlogin_attempt — 810810trap_enumtrap_enum — 101101user_enumerationuser_enumeration — 9696attack_payloadattack_payload — 3737xmlrpc_callxmlrpc_call — 2828contact_messagecontact_message — 1313contact_spamcontact_spam — 1212file_uploadfile_upload — 77
Show data table
ValueEvents
xmlrpc_credentials11,743
not_found_scan4,335
security_probe3,389
bait_path2,800
login_attempt810
trap_enum101
user_enumeration96
attack_payload37
xmlrpc_call28
contact_message13
contact_spam12
file_upload7

Attacker tooling

The software making the requests, identified from how each client presents itself. Commodity scanners dominate; anything hand-driven stands out.

headless-clientheadless-client — 7,7287,728search-crawlersearch-crawler — 628628seo-crawlerseo-crawler — 293293scripted-clientscripted-client — 5050python-httppython-http — 2525go-httpgo-http — 2323curlcurl — 1616java-httpjava-http — 88no-user-agentno-user-agent — 33
Show data table
ValueEvents
headless-client7,728
search-crawler628
seo-crawler293
scripted-client50
python-http25
go-http23
curl16
java-http8
no-user-agent3

Most common attacks

Each label is one recognised technique or vulnerable endpoint.

metaWeblog.newPostmetaWeblog.newPost — 11,27011,270/wp-content/plugins/wordfence/imag…/wp-content/plugins/wordfence/images/wordfence-logo.svg — 4,1074,107security-plugin-probesecurity-plugin-probe — 3,3893,389decoy-asset-probedecoy-asset-probe — 1,1861,186wp-loginwp-login — 485485own-asset-fetchown-asset-fetch — 396396system.multicallsystem.multicall — 362362wp-login-harvested-identitywp-login-harvested-identity — 325325advertised-plugin-probeadvertised-plugin-probe — 307307plugin-version-probeplugin-version-probe — 248248wp.getUsersBlogswp.getUsersBlogs — 128128login-pagelogin-page — 123123
Show data table
ValueEvents
metaWeblog.newPost11,270
/wp-content/plugins/wordfence/images/wordfence-logo.svg4,107
security-plugin-probe3,389
decoy-asset-probe1,186
wp-login485
own-asset-fetch396
system.multicall362
wp-login-harvested-identity325
advertised-plugin-probe307
plugin-version-probe248
wp.getUsersBlogs128
login-page123

Adversary techniques observed

Each bar is a MITRE ATT&CK technique, counted from the events this honeypot recorded. These are techniques currently being used against small business websites, not a theoretical list.

T1110.003 Brute Force: Password Spray…T1110.003 Brute Force: Password Spraying — Credential Access — 11,76711,767T1518 Software DiscoveryT1518 Software Discovery — Discovery — 5,1705,170T1595.003 Active Scanning: Wordlist S…T1595.003 Active Scanning: Wordlist Scanning — Reconnaissance — 4,4444,444T1595.002 Active Scanning: Vulnerabil…T1595.002 Active Scanning: Vulnerability Scanning — Reconnaissance — 3,6423,642T1083 File and Directory DiscoveryT1083 File and Directory Discovery — Discovery — 2,8302,830T1110.001 Brute Force: Password Guess…T1110.001 Brute Force: Password Guessing — Credential Access — 1,2241,224T1078 Valid AccountsT1078 Valid Accounts — Initial Access — 819819T1087 Account DiscoveryT1087 Account Discovery — Discovery — 388388T1589 Gather Victim Identity Informat…T1589 Gather Victim Identity Information — Reconnaissance — 379379T1592.002 Gather Victim Host Informat…T1592.002 Gather Victim Host Information: Software — Reconnaissance — 355355T1552.001 Unsecured Credentials: Cred…T1552.001 Unsecured Credentials: Credentials In Files — Credential Access — 339339T1505.003 Server Software Component: …T1505.003 Server Software Component: Web Shell — Persistence — 194194
Show data table
IDTechniqueTacticEvents
T1110.003Brute Force: Password SprayingCredential Access11,767
T1518Software DiscoveryDiscovery5,170
T1595.003Active Scanning: Wordlist ScanningReconnaissance4,444
T1595.002Active Scanning: Vulnerability ScanningReconnaissance3,642
T1083File and Directory DiscoveryDiscovery2,830
T1110.001Brute Force: Password GuessingCredential Access1,224
T1078Valid AccountsInitial Access819
T1087Account DiscoveryDiscovery388
T1589Gather Victim Identity InformationReconnaissance379
T1592.002Gather Victim Host Information: SoftwareReconnaissance355
T1552.001Unsecured Credentials: Credentials In FilesCredential Access339
T1505.003Server Software Component: Web ShellPersistence194

Where the attacks come from

Resolved from the busiest source addresses, which between them account for 28% of all recorded events. Countries are read from the addresses traffic arrives from, which is where it was routed from rather than necessarily where whoever sent it is.

🇬🇧 United Kingdom🇬🇧 United Kingdom — 3,7493,749🇮🇳 India🇮🇳 India — 1,1341,134🇧🇩 Bangladesh🇧🇩 Bangladesh — 515515🇵🇰 Pakistan🇵🇰 Pakistan — 283283🇷🇸 Serbia🇷🇸 Serbia — 150150🇵🇭 Philippines🇵🇭 Philippines — 150150🇺🇸 United States🇺🇸 United States — 150150🇳🇵 Nepal🇳🇵 Nepal — 148148🇨🇳 China🇨🇳 China — 143143🇩🇪 Germany🇩🇪 Germany — 129129
Show data table
ValueEvents
🇬🇧 United Kingdom3,749
🇮🇳 India1,134
🇧🇩 Bangladesh515
🇵🇰 Pakistan283
🇷🇸 Serbia150
🇵🇭 Philippines150
🇺🇸 United States150
🇳🇵 Nepal148
🇨🇳 China143
🇩🇪 Germany129

How far attackers got

Distinct source addresses, counted once each at the deepest level they reached. Every bar contains the ones below it, so the width can only shrink; the drop from one bar to the next is how many stopped at that step.

InformationalInformational — 1,857 sources (100% of all)1,857 (100%)Targeted reconTargeted recon — 1,749 sources (94% of all)1,749 (94%)108 stopped hereLoot huntingLoot hunting — 1,333 sources (72% of all)1,333 (72%)416 stopped hereExploitation attemptExploitation attempt — 1,304 sources (70% of all)1,304 (70%)29 stopped hereCredential or upload attackCredential or upload attack — 1,091 sources (59% of all)1,091 (59%)213 stopped hereCritical — hands-onCritical — hands-on — 180 sources (10% of all)180 (10%)911 stopped here
Show data table
Reached at leastSourcesShareStopped here
Informational1,857100%—
Targeted recon1,74994%108
Loot hunting1,33372%416
Exploitation attempt1,30470%29
Credential or upload attack1,09159%213
Critical — hands-on18010%911

Critical events

39 critical events in the last 14 days. Each mark is a day something reached the top of the severity ladder — a canary token fired from off-site, a shell uploaded, a decoy account used. Clusters matter more than the count: several in one day is usually one operator working.

19 Oct20 Oct21 Oct22 Oct23 Oct24 Oct25 Oct26 Oct27 Oct28 Oct29 Oct — 1 critical events129 Oct30 Oct31 Oct1 Nov — 38 critical events381 Nov
Show data table
DayCritical events
19 Oct0
20 Oct0
21 Oct0
22 Oct0
23 Oct0
24 Oct0
25 Oct0
26 Oct0
27 Oct0
28 Oct0
29 Oct1
30 Oct0
31 Oct0
1 Nov38

New and returning sources

Distinct addresses per day. "First time" means never seen before at all, not merely not seen that day. Churn of one-off addresses is ordinary background scanning; addresses that keep coming back are worth a closer look.

  • Seen before
  • First time
0153019 Oct — Seen before: 719 Oct — First time: 111819 Oct20 Oct — Seen before: 620 Oct — First time: 3920 Oct21 Oct — Seen before: 821 Oct — First time: 132121 Oct22 Oct — Seen before: 822 Oct — First time: 162422 Oct23 Oct — Seen before: 623 Oct — First time: 121823 Oct24 Oct — Seen before: 724 Oct — First time: 121924 Oct25 Oct — Seen before: 825 Oct — First time: 101825 Oct26 Oct — Seen before: 726 Oct — First time: 2926 Oct27 Oct — Seen before: 827 Oct — First time: 31127 Oct28 Oct — Seen before: 828 Oct — First time: 71528 Oct29 Oct — Seen before: 529 Oct — First time: 121729 Oct30 Oct — Seen before: 930 Oct — First time: 152430 Oct31 Oct — Seen before: 831 Oct — First time: 111931 Oct1 Nov — Seen before: 91 Nov — First time: 3121 Nov
Show data table
DayFirst timeSeen beforeTotal
19 Oct11718
20 Oct369
21 Oct13821
22 Oct16824
23 Oct12618
24 Oct12719
25 Oct10818
26 Oct279
27 Oct3811
28 Oct7815
29 Oct12517
30 Oct15924
31 Oct11819
1 Nov3912

Activity by day of the week

A flat week is automation, which does not know what a weekend is. A weekday-shaped week means a person is choosing when to work — the same reading as the hourly chart, at a scale that shows a pattern the hours cannot.

  • Weekday
  • Weekend
02,5005,000Mon — 4,3964,396MonTue — 3,2013,201TueWed — 3,2933,293WedThu — 2,7752,775ThuFri — 2,8682,868FriSat — 3,5533,553SatSun — 3,2973,297Sun
Show data table
DayEvents
Mon4,396
Tue3,201
Wed3,293
Thu2,775
Fri2,868
Sat3,553
Sun3,297

Busiest source addresses

Addresses are shared, reassigned and often spoofed, so treat these as traffic sources rather than as identities.

80.76.57.1380.76.57.13 — 90590588.97.176.17388.97.176.173 — 71571594.197.234.12394.197.234.123 — 37737786.18.50.10386.18.50.103 — 34534578.148.64.1678.148.64.16 — 27627688.97.176.20588.97.176.205 — 26926945.150.145.1545.150.145.15 — 226226103.174.1.98103.174.1.98 — 22322386.153.2.13286.153.2.132 — 18018078.148.77.21078.148.77.210 — 165165
Show data table
ValueEvents
80.76.57.13905
88.97.176.173715
94.197.234.123377
86.18.50.103345
78.148.64.16276
88.97.176.205269
45.150.145.15226
103.174.1.98223
86.153.2.132180
78.148.77.210165

Most tried usernames

The account names attackers guessed at.

adminadmin — 414414MonitoringMonitoring — 130130EditorialEditorial — 8181DeployDeploy — 7979sarahsarah — 3636sarahkimsarahkim — 3232jmorrisjmorris — 3030devopsdevops — 3030tbibasmashtbibasmash — 2626contentcontent — 2525
Show data table
ValueEvents
admin414
Monitoring130
Editorial81
Deploy79
sarah36
sarahkim32
jmorris30
devops30
tbibasmash26
content25

Most tried passwords

Taken from the dictionaries currently in circulation. If one of these is familiar, change it.

adminadmin — 5959passpass — 3333passwordpassword — 3131admin123admin123 — 2525stoneandrazorbarberstoneandrazorbarber — 2424adminadminadminadmin — 2323user%02user%02 — 2222MonitoringMonitoring — 2020stoneandrazorbarber123stoneandrazorbarber123 — 2020admin2025admin2025 — 1717
Show data table
ValueEvents
admin59
pass33
password31
admin12325
stoneandrazorbarber24
adminadmin23
user%0222
Monitoring20
stoneandrazorbarber12320
admin202517

Updated 23 minutes ago. Source: SparTech Software Honeypot Project.

SparTech Software Honeypot Project

10,871Events recorded
166Today
1,225Distinct sources
1,628Attacks on login or upload
46Hands-on intrusions
4Enumeration sweeps

Event volume by severity

Last 14 days. Tall pale bars are ordinary background scanning; dark segments are attempts that carried credentials or a payload.

  • Recon (sev 1-2)
  • Loot hunting (sev 3)
  • Attack (sev 4-5)
  • Critical (sev 6)
017535019 Oct — Recon (sev 1-2): 5919 Oct — Loot hunting (sev 3): 119 Oct — Attack (sev 4-5): 4810819 Oct20 Oct — Recon (sev 1-2): 5620 Oct — Attack (sev 4-5): 4610220 Oct21 Oct — Recon (sev 1-2): 7221 Oct — Loot hunting (sev 3): 421 Oct — Attack (sev 4-5): 26534221 Oct22 Oct — Recon (sev 1-2): 5822 Oct — Loot hunting (sev 3): 222 Oct — Attack (sev 4-5): 7713722 Oct23 Oct — Recon (sev 1-2): 6923 Oct — Attack (sev 4-5): 4711623 Oct24 Oct — Recon (sev 1-2): 5524 Oct — Loot hunting (sev 3): 124 Oct — Attack (sev 4-5): 5310924 Oct25 Oct — Recon (sev 1-2): 6125 Oct — Attack (sev 4-5): 5211325 Oct26 Oct — Recon (sev 1-2): 8326 Oct — Attack (sev 4-5): 16625126 Oct27 Oct — Recon (sev 1-2): 5927 Oct — Loot hunting (sev 3): 427 Oct — Attack (sev 4-5): 4911227 Oct28 Oct — Recon (sev 1-2): 5428 Oct — Attack (sev 4-5): 5210728 Oct29 Oct — Recon (sev 1-2): 7129 Oct — Attack (sev 4-5): 5112229 Oct30 Oct — Recon (sev 1-2): 7530 Oct — Loot hunting (sev 3): 230 Oct — Attack (sev 4-5): 5012830 Oct31 Oct — Recon (sev 1-2): 4931 Oct — Attack (sev 4-5): 5510431 Oct1 Nov — Recon (sev 1-2): 1131 Nov — Attack (sev 4-5): 421581 Nov
Show data table
DayRecon (sev 1-2)Loot hunting (sev 3)Attack (sev 4-5)Total
19 Oct59148108
20 Oct56046102
21 Oct724265342
22 Oct58277137
23 Oct69047116
24 Oct55153109
25 Oct61052113
26 Oct830166251
27 Oct59449112
28 Oct54052107
29 Oct71051122
30 Oct75250128
31 Oct49055104
1 Nov113042158

Severity mix

The scale measures engagement depth. 1-2 is recon, 3 is hunting for loot, 4 is an exploit being attempted, 5 is an attack on the login or upload surface, and 6 means somebody acted on what they took.

Severity 1, Informational — 4,598 events (42%)Severity 2, Targeted recon — 974 events (9%)Severity 3, Loot hunting — 103 events (1%)Severity 4, Exploitation attempt — 3,568 events (33%)Severity 5, Credential or upload attack — 1,582 events (15%)Severity 6, Critical — hands-on — 46 events (0%)10,871eventsInformational4,598 · 42%Targeted recon974 · 9%Loot hunting103 · 1%Exploitation attempt3,568 · 33%Credential or upload attack1,582 · 15%Critical — hands-on46 · 0%
Show data table
SeverityLevelEventsShare
1Informational4,59842%
2Targeted recon9749%
3Loot hunting1031%
4Exploitation attempt3,56833%
5Credential or upload attack1,58215%
6Critical — hands-on460%

Activity by hour of day

Flat coverage across all 24 hours is the signature of automation. Humans cluster into working hours, and the shaded band is the stretch nobody is choosing to work through.

  • Daytime and evening
  • Small hours (00:00-05:59)
040080000:00-00:59 — 408 events0001:00-01:59 — 480 events02:00-02:59 — 414 events03:00-03:59 — 377 events0304:00-04:59 — 375 events05:00-05:59 — 341 events06:00-06:59 — 414 events0607:00-07:59 — 341 events08:00-08:59 — 434 events09:00-09:59 — 455 events0910:00-10:59 — 574 events11:00-11:59 — 554 events12:00-12:59 — 342 events1213:00-13:59 — 538 events14:00-14:59 — 648 events15:00-15:59 — 463 events1516:00-16:59 — 545 events17:00-17:59 — 377 events18:00-18:59 — 357 events1819:00-19:59 — 371 events20:00-20:59 — 503 events21:00-21:59 — 502 events2122:00-22:59 — 719 events23:00-23:59 — 339 events
Show data table
HourEvents
00:00408
01:00480
02:00414
03:00377
04:00375
05:00341
06:00414
07:00341
08:00434
09:00455
10:00574
11:00554
12:00342
13:00538
14:00648
15:00463
16:00545
17:00377
18:00357
19:00371
20:00503
21:00502
22:00719
23:00339

Top event types

What the honeypot caught people doing, counted over everything it has recorded.

not_found_scannot_found_scan — 4,3584,358security_probesecurity_probe — 3,3523,352xmlrpc_credentialsxmlrpc_credentials — 1,5011,501bait_pathbait_path — 1,3301,330login_attemptlogin_attempt — 110110trap_enumtrap_enum — 102102xmlrpc_callxmlrpc_call — 5151user_enumerationuser_enumeration — 3535attack_payloadattack_payload — 1111file_uploadfile_upload — 55campaigncampaign — 44login_successlogin_success — 44
Show data table
ValueEvents
not_found_scan4,358
security_probe3,352
xmlrpc_credentials1,501
bait_path1,330
login_attempt110
trap_enum102
xmlrpc_call51
user_enumeration35
attack_payload11
file_upload5
campaign4
login_success4

Attacker tooling

The software making the requests, identified from how each client presents itself. Commodity scanners dominate; anything hand-driven stands out.

headless-clientheadless-client — 7,6327,632search-crawlersearch-crawler — 265265seo-crawlerseo-crawler — 172172python-httppython-http — 7676java-httpjava-http — 77scripted-clientscripted-client — 66no-user-agentno-user-agent — 33curlcurl — 11go-httpgo-http — 11
Show data table
ValueEvents
headless-client7,632
search-crawler265
seo-crawler172
python-http76
java-http7
scripted-client6
no-user-agent3
curl1
go-http1

Most common attacks

Each label is one recognised technique or vulnerable endpoint.

/wp-content/plugins/wordfence/imag…/wp-content/plugins/wordfence/images/wordfence-logo.svg — 4,1434,143security-plugin-probesecurity-plugin-probe — 3,3523,352wp.getUsersBlogswp.getUsersBlogs — 739739system.multicallsystem.multicall — 566566decoy-asset-probedecoy-asset-probe — 478478plugin-version-probeplugin-version-probe — 262262metaWeblog.newPostmetaWeblog.newPost — 226226login-pagelogin-page — 179179dropped-shell-probedropped-shell-probe — 145145author-enumauthor-enum — 104104author-enumerationauthor-enumeration — 9898wp-loginwp-login — 9898
Show data table
ValueEvents
/wp-content/plugins/wordfence/images/wordfence-logo.svg4,143
security-plugin-probe3,352
wp.getUsersBlogs739
system.multicall566
decoy-asset-probe478
plugin-version-probe262
metaWeblog.newPost226
login-page179
dropped-shell-probe145
author-enum104
author-enumeration98
wp-login98

Adversary techniques observed

Each bar is a MITRE ATT&CK technique, counted from the events this honeypot recorded. These are techniques currently being used against small business websites, not a theoretical list.

T1595.003 Active Scanning: Wordlist S…T1595.003 Active Scanning: Wordlist Scanning — Reconnaissance — 4,4654,465T1518 Software DiscoveryT1518 Software Discovery — Discovery — 4,1344,134T1595.002 Active Scanning: Vulnerabil…T1595.002 Active Scanning: Vulnerability Scanning — Reconnaissance — 3,6183,618T1110.003 Brute Force: Password Spray…T1110.003 Brute Force: Password Spraying — Credential Access — 1,5301,530T1083 File and Directory DiscoveryT1083 File and Directory Discovery — Discovery — 1,3341,334T1110.001 Brute Force: Password Guess…T1110.001 Brute Force: Password Guessing — Credential Access — 734734T1087 Account DiscoveryT1087 Account Discovery — Discovery — 274274T1589 Gather Victim Identity Informat…T1589 Gather Victim Identity Information — Reconnaissance — 270270T1505.003 Server Software Component: …T1505.003 Server Software Component: Web Shell — Persistence — 181181T1595 Active ScanningT1595 Active Scanning — Reconnaissance — 179179T1078 Valid AccountsT1078 Valid Accounts — Initial Access — 117117T1190 Exploit Public-Facing Applicati…T1190 Exploit Public-Facing Application — Initial Access — 4646
Show data table
IDTechniqueTacticEvents
T1595.003Active Scanning: Wordlist ScanningReconnaissance4,465
T1518Software DiscoveryDiscovery4,134
T1595.002Active Scanning: Vulnerability ScanningReconnaissance3,618
T1110.003Brute Force: Password SprayingCredential Access1,530
T1083File and Directory DiscoveryDiscovery1,334
T1110.001Brute Force: Password GuessingCredential Access734
T1087Account DiscoveryDiscovery274
T1589Gather Victim Identity InformationReconnaissance270
T1505.003Server Software Component: Web ShellPersistence181
T1595Active ScanningReconnaissance179
T1078Valid AccountsInitial Access117
T1190Exploit Public-Facing ApplicationInitial Access46

Where the attacks come from

Resolved from the busiest source addresses, which between them account for 52% of all recorded events. Countries are read from the addresses traffic arrives from, which is where it was routed from rather than necessarily where whoever sent it is.

🇬🇧 United Kingdom🇬🇧 United Kingdom — 4,6944,694🇦🇺 Australia🇦🇺 Australia — 362362🇩🇪 Germany🇩🇪 Germany — 227227🇻🇳 Viet Nam🇻🇳 Viet Nam — 120120🇳🇿 New Zealand🇳🇿 New Zealand — 118118🇮🇪 Ireland🇮🇪 Ireland — 9090🇯🇵 Japan🇯🇵 Japan — 7171
Show data table
ValueEvents
🇬🇧 United Kingdom4,694
🇦🇺 Australia362
🇩🇪 Germany227
🇻🇳 Viet Nam120
🇳🇿 New Zealand118
🇮🇪 Ireland90
🇯🇵 Japan71

How far attackers got

Distinct source addresses, counted once each at the deepest level they reached. Every bar contains the ones below it, so the width can only shrink; the drop from one bar to the next is how many stopped at that step.

InformationalInformational — 1,225 sources (100% of all)1,225 (100%)Targeted reconTargeted recon — 1,103 sources (90% of all)1,103 (90%)122 stopped hereLoot huntingLoot hunting — 801 sources (65% of all)801 (65%)302 stopped hereExploitation attemptExploitation attempt — 736 sources (60% of all)736 (60%)65 stopped hereCredential or upload attackCredential or upload attack — 528 sources (43% of all)528 (43%)208 stopped hereCritical — hands-onCritical — hands-on — 41 sources (3% of all)41 (3%)487 stopped here
Show data table
Reached at leastSourcesShareStopped here
Informational1,225100%—
Targeted recon1,10390%122
Loot hunting80165%302
Exploitation attempt73660%65
Credential or upload attack52843%208
Critical — hands-on413%487

Critical events

8 critical events in the last 14 days. Each mark is a day something reached the top of the severity ladder — a canary token fired from off-site, a shell uploaded, a decoy account used. Clusters matter more than the count: several in one day is usually one operator working.

19 Oct20 Oct21 Oct — 1 critical events121 Oct22 Oct23 Oct24 Oct25 Oct26 Oct — 2 critical events226 Oct27 Oct28 Oct — 1 critical events128 Oct29 Oct30 Oct — 1 critical events130 Oct31 Oct1 Nov — 3 critical events31 Nov
Show data table
DayCritical events
19 Oct0
20 Oct0
21 Oct1
22 Oct0
23 Oct0
24 Oct0
25 Oct0
26 Oct2
27 Oct0
28 Oct1
29 Oct0
30 Oct1
31 Oct0
1 Nov3

New and returning sources

Distinct addresses per day. "First time" means never seen before at all, not merely not seen that day. Churn of one-off addresses is ordinary background scanning; addresses that keep coming back are worth a closer look.

  • Seen before
  • First time
0153019 Oct — Seen before: 519 Oct — First time: 71219 Oct20 Oct — Seen before: 520 Oct — First time: 2720 Oct21 Oct — Seen before: 521 Oct — First time: 152021 Oct22 Oct — Seen before: 522 Oct — First time: 71222 Oct23 Oct — Seen before: 523 Oct — First time: 162123 Oct24 Oct — Seen before: 724 Oct — First time: 121924 Oct25 Oct — Seen before: 725 Oct — First time: 121925 Oct26 Oct — Seen before: 926 Oct — First time: 142326 Oct27 Oct — Seen before: 627 Oct — First time: 61227 Oct28 Oct — Seen before: 628 Oct — First time: 61228 Oct29 Oct — Seen before: 729 Oct — First time: 182529 Oct30 Oct — Seen before: 630 Oct — First time: 131930 Oct31 Oct — Seen before: 831 Oct — First time: 81631 Oct1 Nov — Seen before: 61 Nov — First time: 9151 Nov
Show data table
DayFirst timeSeen beforeTotal
19 Oct7512
20 Oct257
21 Oct15520
22 Oct7512
23 Oct16521
24 Oct12719
25 Oct12719
26 Oct14923
27 Oct6612
28 Oct6612
29 Oct18725
30 Oct13619
31 Oct8816
1 Nov9615

Activity by day of the week

A flat week is automation, which does not know what a weekend is. A weekday-shaped week means a person is choosing when to work — the same reading as the hourly chart, at a scale that shows a pattern the hours cannot.

  • Weekday
  • Weekend
09001,800Mon — 1,6181,618MonTue — 1,5321,532TueWed — 1,6071,607WedThu — 1,5461,546ThuFri — 1,5541,554FriSat — 1,5521,552SatSun — 1,4621,462Sun
Show data table
DayEvents
Mon1,618
Tue1,532
Wed1,607
Thu1,546
Fri1,554
Sat1,552
Sun1,462

Busiest source addresses

Addresses are shared, reassigned and often spoofed, so treat these as traffic sources rather than as identities.

80.76.57.1380.76.57.13 — 93993988.97.176.17388.97.176.173 — 72572594.197.234.12394.197.234.123 — 38638686.18.50.10386.18.50.103 — 33333388.97.176.20588.97.176.205 — 26726778.148.64.1678.148.64.16 — 25225285.93.10.24785.93.10.247 — 22722745.150.145.1545.150.145.15 — 21121186.153.2.13286.153.2.132 — 17617678.148.77.21078.148.77.210 — 167167
Show data table
ValueEvents
80.76.57.13939
88.97.176.173725
94.197.234.123386
86.18.50.103333
88.97.176.205267
78.148.64.16252
85.93.10.247227
45.150.145.15211
86.153.2.132176
78.148.77.210167

Most tried usernames

The account names attackers guessed at.

adminadmin — 297297DeployDeploy — 126126tmalleytmalley — 9999jmorrisjmorris — 8888monitormonitor — 7474MonitoringMonitoring — 6060backupbackup — 3131dwhitedwhite — 2929nizeezcinizeezci — 1111rootroot — 1010
Show data table
ValueEvents
admin297
Deploy126
tmalley99
jmorris88
monitor74
Monitoring60
backup31
dwhite29
nizeezci11
root10

Most tried passwords

Taken from the dictionaries currently in circulation. If one of these is familiar, change it.

passpass — 4949password1password1 — 4040adminadmin — 2929Password123Password123 — 222212345678901234567890 — 2121P@ssw0rdP@ssw0rd — 2020P@ssw0rd123P@ssw0rd123 — 2020DeployDeploy — 1414tmalleytmalley — 1212adminadminadminadmin — 1212
Show data table
ValueEvents
pass49
password140
admin29
Password12322
123456789021
P@ssw0rd20
P@ssw0rd12320
Deploy14
tmalley12
adminadmin12

Updated 2 minutes ago. Source: SparTech Software Honeypot Project.

SparTech Software Honeypot Project

23,030Events recorded
42Today
1,844Distinct sources
12,474Attacks on login or upload
315Hands-on intrusions
8Enumeration sweeps

Event volume by severity

Last 14 days. Tall pale bars are ordinary background scanning; dark segments are attempts that carried credentials or a payload.

  • Recon (sev 1-2)
  • Loot hunting (sev 3)
  • Attack (sev 4-5)
  • Critical (sev 6)
09018019 Oct — Recon (sev 1-2): 9119 Oct — Loot hunting (sev 3): 119 Oct — Attack (sev 4-5): 5915119 Oct20 Oct — Recon (sev 1-2): 7120 Oct — Attack (sev 4-5): 10517620 Oct21 Oct — Recon (sev 1-2): 9521 Oct — Loot hunting (sev 3): 121 Oct — Attack (sev 4-5): 8017621 Oct22 Oct — Recon (sev 1-2): 8222 Oct — Loot hunting (sev 3): 122 Oct — Attack (sev 4-5): 5113422 Oct23 Oct — Recon (sev 1-2): 6423 Oct — Attack (sev 4-5): 5612023 Oct24 Oct — Recon (sev 1-2): 5424 Oct — Attack (sev 4-5): 5210624 Oct25 Oct — Recon (sev 1-2): 5725 Oct — Attack (sev 4-5): 5411125 Oct26 Oct — Recon (sev 1-2): 5026 Oct — Attack (sev 4-5): 8613626 Oct27 Oct — Recon (sev 1-2): 11927 Oct — Loot hunting (sev 3): 627 Oct — Attack (sev 4-5): 5317827 Oct28 Oct — Recon (sev 1-2): 5728 Oct — Attack (sev 4-5): 4710428 Oct29 Oct — Recon (sev 1-2): 6029 Oct — Loot hunting (sev 3): 129 Oct — Attack (sev 4-5): 5111329 Oct30 Oct — Recon (sev 1-2): 7830 Oct — Attack (sev 4-5): 5613430 Oct31 Oct — Recon (sev 1-2): 2131 Oct — Attack (sev 4-5): 214231 Oct1 Nov
Show data table
DayRecon (sev 1-2)Loot hunting (sev 3)Attack (sev 4-5)Total
19 Oct91159151
20 Oct710105176
21 Oct95180176
22 Oct82151134
23 Oct64056120
24 Oct54052106
25 Oct57054111
26 Oct50086136
27 Oct119653178
28 Oct57047104
29 Oct60151113
30 Oct78056134
31 Oct2102142
1 Nov0000

Severity mix

The scale measures engagement depth. 1-2 is recon, 3 is hunting for loot, 4 is an exploit being attempted, 5 is an attack on the login or upload surface, and 6 means somebody acted on what they took.

Severity 1, Informational — 4,784 events (21%)Severity 2, Targeted recon — 2,061 events (9%)Severity 3, Loot hunting — 136 events (1%)Severity 4, Exploitation attempt — 3,575 events (16%)Severity 5, Credential or upload attack — 12,159 events (53%)Severity 6, Critical — hands-on — 315 events (1%)23,030eventsInformational4,784 · 21%Targeted recon2,061 · 9%Loot hunting136 · 1%Exploitation attempt3,575 · 16%Credential or upload attack12,159 · 53%Critical — hands-on315 · 1%
Show data table
SeverityLevelEventsShare
1Informational4,78421%
2Targeted recon2,0619%
3Loot hunting1361%
4Exploitation attempt3,57516%
5Credential or upload attack12,15953%
6Critical — hands-on3151%

Activity by hour of day

Flat coverage across all 24 hours is the signature of automation. Humans cluster into working hours, and the shaded band is the stretch nobody is choosing to work through.

  • Daytime and evening
  • Small hours (00:00-05:59)
01,2502,50000:00-00:59 — 1,504 events0001:00-01:59 — 2,302 events02:00-02:59 — 895 events03:00-03:59 — 1,490 events0304:00-04:59 — 967 events05:00-05:59 — 897 events06:00-06:59 — 1,368 events0607:00-07:59 — 1,089 events08:00-08:59 — 1,159 events09:00-09:59 — 773 events0910:00-10:59 — 1,089 events11:00-11:59 — 1,028 events12:00-12:59 — 934 events1213:00-13:59 — 756 events14:00-14:59 — 445 events15:00-15:59 — 656 events1516:00-16:59 — 533 events17:00-17:59 — 1,093 events18:00-18:59 — 784 events1819:00-19:59 — 472 events20:00-20:59 — 667 events21:00-21:59 — 581 events2122:00-22:59 — 678 events23:00-23:59 — 870 events
Show data table
HourEvents
00:001,504
01:002,302
02:00895
03:001,490
04:00967
05:00897
06:001,368
07:001,089
08:001,159
09:00773
10:001,089
11:001,028
12:00934
13:00756
14:00445
15:00656
16:00533
17:001,093
18:00784
19:00472
20:00667
21:00581
22:00678
23:00870

Top event types

What the honeypot caught people doing, counted over everything it has recorded.

xmlrpc_credentialsxmlrpc_credentials — 11,73511,735not_found_scannot_found_scan — 4,2064,206security_probesecurity_probe — 3,3463,346bait_pathbait_path — 2,7412,741login_attemptlogin_attempt — 719719trap_enumtrap_enum — 9898user_enumerationuser_enumeration — 9494xmlrpc_callxmlrpc_call — 2828attack_payloadattack_payload — 2727contact_messagecontact_message — 1212contact_spamcontact_spam — 1212login_successlogin_success — 77
Show data table
ValueEvents
xmlrpc_credentials11,735
not_found_scan4,206
security_probe3,346
bait_path2,741
login_attempt719
trap_enum98
user_enumeration94
xmlrpc_call28
attack_payload27
contact_message12
contact_spam12
login_success7

Attacker tooling

The software making the requests, identified from how each client presents itself. Commodity scanners dominate; anything hand-driven stands out.

headless-clientheadless-client — 7,4987,498search-crawlersearch-crawler — 621621seo-crawlerseo-crawler — 287287scripted-clientscripted-client — 5050python-httppython-http — 2525go-httpgo-http — 2323curlcurl — 1616java-httpjava-http — 88no-user-agentno-user-agent — 33
Show data table
ValueEvents
headless-client7,498
search-crawler621
seo-crawler287
scripted-client50
python-http25
go-http23
curl16
java-http8
no-user-agent3

Most common attacks

Each label is one recognised technique or vulnerable endpoint.

metaWeblog.newPostmetaWeblog.newPost — 11,27011,270/wp-content/plugins/wordfence/imag…/wp-content/plugins/wordfence/images/wordfence-logo.svg — 4,0634,063security-plugin-probesecurity-plugin-probe — 3,3463,346decoy-asset-probedecoy-asset-probe — 1,1731,173wp-loginwp-login — 425425own-asset-fetchown-asset-fetch — 396396system.multicallsystem.multicall — 354354advertised-plugin-probeadvertised-plugin-probe — 307307wp-login-harvested-identitywp-login-harvested-identity — 294294plugin-version-probeplugin-version-probe — 226226wp.getUsersBlogswp.getUsersBlogs — 128128login-pagelogin-page — 122122
Show data table
ValueEvents
metaWeblog.newPost11,270
/wp-content/plugins/wordfence/images/wordfence-logo.svg4,063
security-plugin-probe3,346
decoy-asset-probe1,173
wp-login425
own-asset-fetch396
system.multicall354
advertised-plugin-probe307
wp-login-harvested-identity294
plugin-version-probe226
wp.getUsersBlogs128
login-page122

Adversary techniques observed

Each bar is a MITRE ATT&CK technique, counted from the events this honeypot recorded. These are techniques currently being used against small business websites, not a theoretical list.

T1110.003 Brute Force: Password Spray…T1110.003 Brute Force: Password Spraying — Credential Access — 11,75911,759T1518 Software DiscoveryT1518 Software Discovery — Discovery — 5,0915,091T1595.003 Active Scanning: Wordlist S…T1595.003 Active Scanning: Wordlist Scanning — Reconnaissance — 4,3094,309T1595.002 Active Scanning: Vulnerabil…T1595.002 Active Scanning: Vulnerability Scanning — Reconnaissance — 3,5753,575T1083 File and Directory DiscoveryT1083 File and Directory Discovery — Discovery — 2,7612,761T1110.001 Brute Force: Password Guess…T1110.001 Brute Force: Password Guessing — Credential Access — 1,1231,123T1078 Valid AccountsT1078 Valid Accounts — Initial Access — 728728T1087 Account DiscoveryT1087 Account Discovery — Discovery — 379379T1589 Gather Victim Identity Informat…T1589 Gather Victim Identity Information — Reconnaissance — 371371T1592.002 Gather Victim Host Informat…T1592.002 Gather Victim Host Information: Software — Reconnaissance — 355355T1552.001 Unsecured Credentials: Cred…T1552.001 Unsecured Credentials: Credentials In Files — Credential Access — 308308T1505.003 Server Software Component: …T1505.003 Server Software Component: Web Shell — Persistence — 172172
Show data table
IDTechniqueTacticEvents
T1110.003Brute Force: Password SprayingCredential Access11,759
T1518Software DiscoveryDiscovery5,091
T1595.003Active Scanning: Wordlist ScanningReconnaissance4,309
T1595.002Active Scanning: Vulnerability ScanningReconnaissance3,575
T1083File and Directory DiscoveryDiscovery2,761
T1110.001Brute Force: Password GuessingCredential Access1,123
T1078Valid AccountsInitial Access728
T1087Account DiscoveryDiscovery379
T1589Gather Victim Identity InformationReconnaissance371
T1592.002Gather Victim Host Information: SoftwareReconnaissance355
T1552.001Unsecured Credentials: Credentials In FilesCredential Access308
T1505.003Server Software Component: Web ShellPersistence172

Where the attacks come from

Resolved from the busiest source addresses, which between them account for 28% of all recorded events. Countries are read from the addresses traffic arrives from, which is where it was routed from rather than necessarily where whoever sent it is.

🇬🇧 United Kingdom🇬🇧 United Kingdom — 3,7123,712🇮🇳 India🇮🇳 India — 1,1341,134🇧🇩 Bangladesh🇧🇩 Bangladesh — 515515🇵🇰 Pakistan🇵🇰 Pakistan — 283283🇷🇸 Serbia🇷🇸 Serbia — 150150🇺🇸 United States🇺🇸 United States — 150150🇵🇭 Philippines🇵🇭 Philippines — 150150🇳🇵 Nepal🇳🇵 Nepal — 148148🇩🇪 Germany🇩🇪 Germany — 129129🇻🇳 Viet Nam🇻🇳 Viet Nam — 125125
Show data table
ValueEvents
🇬🇧 United Kingdom3,712
🇮🇳 India1,134
🇧🇩 Bangladesh515
🇵🇰 Pakistan283
🇷🇸 Serbia150
🇺🇸 United States150
🇵🇭 Philippines150
🇳🇵 Nepal148
🇩🇪 Germany129
🇻🇳 Viet Nam125

How far attackers got

Distinct source addresses, counted once each at the deepest level they reached. Every bar contains the ones below it, so the width can only shrink; the drop from one bar to the next is how many stopped at that step.

InformationalInformational — 1,844 sources (100% of all)1,844 (100%)Targeted reconTargeted recon — 1,738 sources (94% of all)1,738 (94%)106 stopped hereLoot huntingLoot hunting — 1,328 sources (72% of all)1,328 (72%)410 stopped hereExploitation attemptExploitation attempt — 1,299 sources (70% of all)1,299 (70%)29 stopped hereCredential or upload attackCredential or upload attack — 1,089 sources (59% of all)1,089 (59%)210 stopped hereCritical — hands-onCritical — hands-on — 178 sources (10% of all)178 (10%)911 stopped here
Show data table
Reached at leastSourcesShareStopped here
Informational1,844100%—
Targeted recon1,73894%106
Loot hunting1,32872%410
Exploitation attempt1,29970%29
Credential or upload attack1,08959%210
Critical — hands-on17810%911

Critical events

1 critical event in the last 14 days. Each mark is a day something reached the top of the severity ladder — a canary token fired from off-site, a shell uploaded, a decoy account used. Clusters matter more than the count: several in one day is usually one operator working.

19 Oct20 Oct21 Oct22 Oct23 Oct24 Oct25 Oct26 Oct27 Oct28 Oct29 Oct — 1 critical events129 Oct30 Oct31 Oct1 Nov
Show data table
DayCritical events
19 Oct0
20 Oct0
21 Oct0
22 Oct0
23 Oct0
24 Oct0
25 Oct0
26 Oct0
27 Oct0
28 Oct0
29 Oct1
30 Oct0
31 Oct0
1 Nov0

New and returning sources

Distinct addresses per day. "First time" means never seen before at all, not merely not seen that day. Churn of one-off addresses is ordinary background scanning; addresses that keep coming back are worth a closer look.

  • Seen before
  • First time
0153019 Oct — Seen before: 719 Oct — First time: 101719 Oct20 Oct — Seen before: 620 Oct — First time: 41020 Oct21 Oct — Seen before: 821 Oct — First time: 132121 Oct22 Oct — Seen before: 822 Oct — First time: 162422 Oct23 Oct — Seen before: 623 Oct — First time: 121823 Oct24 Oct — Seen before: 724 Oct — First time: 121924 Oct25 Oct — Seen before: 825 Oct — First time: 101825 Oct26 Oct — Seen before: 726 Oct — First time: 2926 Oct27 Oct — Seen before: 827 Oct — First time: 31127 Oct28 Oct — Seen before: 828 Oct — First time: 71528 Oct29 Oct — Seen before: 629 Oct — First time: 121829 Oct30 Oct — Seen before: 930 Oct — First time: 142330 Oct31 Oct — Seen before: 631 Oct — First time: 2831 Oct1 Nov
Show data table
DayFirst timeSeen beforeTotal
19 Oct10717
20 Oct4610
21 Oct13821
22 Oct16824
23 Oct12618
24 Oct12719
25 Oct10818
26 Oct279
27 Oct3811
28 Oct7815
29 Oct12618
30 Oct14923
31 Oct268
1 Nov000

Activity by day of the week

A flat week is automation, which does not know what a weekend is. A weekday-shaped week means a person is choosing when to work — the same reading as the hourly chart, at a scale that shows a pattern the hours cannot.

  • Weekday
  • Weekend
02,5005,000Mon — 4,5194,519MonTue — 2,9962,996TueWed — 3,5663,566WedThu — 2,8052,805ThuFri — 2,9362,936FriSat — 3,5163,516SatSun — 2,6922,692Sun
Show data table
DayEvents
Mon4,519
Tue2,996
Wed3,566
Thu2,805
Fri2,936
Sat3,516
Sun2,692

Busiest source addresses

Addresses are shared, reassigned and often spoofed, so treat these as traffic sources rather than as identities.

80.76.57.1380.76.57.13 — 89989988.97.176.17388.97.176.173 — 70970994.197.234.12394.197.234.123 — 36336386.18.50.10386.18.50.103 — 33433478.148.64.1678.148.64.16 — 27627688.97.176.20588.97.176.205 — 26926945.150.145.1545.150.145.15 — 226226103.174.1.98103.174.1.98 — 22322386.153.2.13286.153.2.132 — 18018078.148.77.21078.148.77.210 — 165165
Show data table
ValueEvents
80.76.57.13899
88.97.176.173709
94.197.234.123363
86.18.50.103334
78.148.64.16276
88.97.176.205269
45.150.145.15226
103.174.1.98223
86.153.2.132180
78.148.77.210165

Most tried usernames

The account names attackers guessed at.

adminadmin — 382382MonitoringMonitoring — 130130EditorialEditorial — 8181DeployDeploy — 7979jmorrisjmorris — 3030devopsdevops — 3030tbibasmashtbibasmash — 2626contentcontent — 2525tbiba@smashtheman.comtbiba@smashtheman.com — 77rootroot — 66
Show data table
ValueEvents
admin382
Monitoring130
Editorial81
Deploy79
jmorris30
devops30
tbibasmash26
content25
tbiba@smashtheman.com7
root6

Most tried passwords

Taken from the dictionaries currently in circulation. If one of these is familiar, change it.

adminadmin — 5656passpass — 3333passwordpassword — 2828admin123admin123 — 2525stoneandrazorbarberstoneandrazorbarber — 2424adminadminadminadmin — 2323user%02user%02 — 2222MonitoringMonitoring — 2020admin2025admin2025 — 1717stoneandrazorbarber123stoneandrazorbarber123 — 1717
Show data table
ValueEvents
admin56
pass33
password28
admin12325
stoneandrazorbarber24
adminadmin23
user%0222
Monitoring20
admin202517
stoneandrazorbarber12317

Updated 1 day ago. Source: SparTech Software Honeypot Project. This feed has not reported recently, so the figures may be out of date.

SparTech Software Honeypot Project

9,392Events recorded
328Today
1,103Distinct sources
1,464Attacks on login or upload
39Hands-on intrusions
3Enumeration sweeps

Event volume by severity

Last 14 days. Tall pale bars are ordinary background scanning; dark segments are attempts that carried credentials or a payload.

  • Recon (sev 1-2)
  • Loot hunting (sev 3)
  • Attack (sev 4-5)
  • Critical (sev 6)
017535019 Oct — Recon (sev 1-2): 5519 Oct — Loot hunting (sev 3): 119 Oct — Attack (sev 4-5): 4410019 Oct20 Oct — Recon (sev 1-2): 5620 Oct — Attack (sev 4-5): 4610220 Oct21 Oct — Recon (sev 1-2): 6421 Oct — Loot hunting (sev 3): 421 Oct — Attack (sev 4-5): 25932821 Oct22 Oct23 Oct24 Oct25 Oct26 Oct27 Oct28 Oct29 Oct30 Oct31 Oct1 Nov
Show data table
DayRecon (sev 1-2)Loot hunting (sev 3)Attack (sev 4-5)Total
19 Oct55144100
20 Oct56046102
21 Oct644259328
22 Oct0000
23 Oct0000
24 Oct0000
25 Oct0000
26 Oct0000
27 Oct0000
28 Oct0000
29 Oct0000
30 Oct0000
31 Oct0000
1 Nov0000

Severity mix

The scale measures engagement depth. 1-2 is recon, 3 is hunting for loot, 4 is an exploit being attempted, 5 is an attack on the login or upload surface, and 6 means somebody acted on what they took.

Severity 1, Informational — 3,949 events (42%)Severity 2, Targeted recon — 864 events (9%)Severity 3, Loot hunting — 94 events (1%)Severity 4, Exploitation attempt — 3,021 events (32%)Severity 5, Credential or upload attack — 1,425 events (15%)Severity 6, Critical — hands-on — 39 events (0%)9,392eventsInformational3,949 · 42%Targeted recon864 · 9%Loot hunting94 · 1%Exploitation attempt3,021 · 32%Credential or upload attack1,425 · 15%Critical — hands-on39 · 0%
Show data table
SeverityLevelEventsShare
1Informational3,94942%
2Targeted recon8649%
3Loot hunting941%
4Exploitation attempt3,02132%
5Credential or upload attack1,42515%
6Critical — hands-on390%

Activity by hour of day

Flat coverage across all 24 hours is the signature of automation. Humans cluster into working hours, and the shaded band is the stretch nobody is choosing to work through.

  • Daytime and evening
  • Small hours (00:00-05:59)
035070000:00-00:59 — 291 events0001:00-01:59 — 345 events02:00-02:59 — 425 events03:00-03:59 — 336 events0304:00-04:59 — 331 events05:00-05:59 — 289 events06:00-06:59 — 289 events0607:00-07:59 — 367 events08:00-08:59 — 297 events09:00-09:59 — 327 events0910:00-10:59 — 402 events11:00-11:59 — 532 events12:00-12:59 — 497 events1213:00-13:59 — 298 events14:00-14:59 — 455 events15:00-15:59 — 609 events1516:00-16:59 — 408 events17:00-17:59 — 377 events18:00-18:59 — 346 events1819:00-19:59 — 310 events20:00-20:59 — 310 events21:00-21:59 — 447 events2122:00-22:59 — 444 events23:00-23:59 — 660 events
Show data table
HourEvents
00:00291
01:00345
02:00425
03:00336
04:00331
05:00289
06:00289
07:00367
08:00297
09:00327
10:00402
11:00532
12:00497
13:00298
14:00455
15:00609
16:00408
17:00377
18:00346
19:00310
20:00310
21:00447
22:00444
23:00660

Top event types

What the honeypot caught people doing, counted over everything it has recorded.

not_found_scannot_found_scan — 3,7683,768security_probesecurity_probe — 2,8632,863xmlrpc_credentialsxmlrpc_credentials — 1,3531,353bait_pathbait_path — 1,1161,116login_attemptlogin_attempt — 9999trap_enumtrap_enum — 9393xmlrpc_callxmlrpc_call — 4747user_enumerationuser_enumeration — 3030attack_payloadattack_payload — 66login_successlogin_success — 44contact_cached_formcontact_cached_form — 33campaigncampaign — 33
Show data table
ValueEvents
not_found_scan3,768
security_probe2,863
xmlrpc_credentials1,353
bait_path1,116
login_attempt99
trap_enum93
xmlrpc_call47
user_enumeration30
attack_payload6
login_success4
contact_cached_form3
campaign3

Attacker tooling

The software making the requests, identified from how each client presents itself. Commodity scanners dominate; anything hand-driven stands out.

headless-clientheadless-client — 6,5566,556search-crawlersearch-crawler — 245245seo-crawlerseo-crawler — 160160python-httppython-http — 7676java-httpjava-http — 77scripted-clientscripted-client — 44curlcurl — 11
Show data table
ValueEvents
headless-client6,556
search-crawler245
seo-crawler160
python-http76
java-http7
scripted-client4
curl1

Most common attacks

Each label is one recognised technique or vulnerable endpoint.

/wp-content/plugins/wordfence/imag…/wp-content/plugins/wordfence/images/wordfence-logo.svg — 3,6233,623security-plugin-probesecurity-plugin-probe — 2,8632,863wp.getUsersBlogswp.getUsersBlogs — 621621system.multicallsystem.multicall — 566566decoy-asset-probedecoy-asset-probe — 428428plugin-version-probeplugin-version-probe — 231231metaWeblog.newPostmetaWeblog.newPost — 192192login-pagelogin-page — 128128dropped-shell-probedropped-shell-probe — 100100author-enumauthor-enum — 9696author-enumerationauthor-enumeration — 9090wp-loginwp-login — 9090
Show data table
ValueEvents
/wp-content/plugins/wordfence/images/wordfence-logo.svg3,623
security-plugin-probe2,863
wp.getUsersBlogs621
system.multicall566
decoy-asset-probe428
plugin-version-probe231
metaWeblog.newPost192
login-page128
dropped-shell-probe100
author-enum96
author-enumeration90
wp-login90

Adversary techniques observed

Each bar is a MITRE ATT&CK technique, counted from the events this honeypot recorded. These are techniques currently being used against small business websites, not a theoretical list.

T1595.003 Active Scanning: Wordlist S…T1595.003 Active Scanning: Wordlist Scanning — Reconnaissance — 3,8653,865T1518 Software DiscoveryT1518 Software Discovery — Discovery — 3,5563,556T1595.002 Active Scanning: Vulnerabil…T1595.002 Active Scanning: Vulnerability Scanning — Reconnaissance — 3,0973,097T1110.003 Brute Force: Password Spray…T1110.003 Brute Force: Password Spraying — Credential Access — 1,3821,382T1083 File and Directory DiscoveryT1083 File and Directory Discovery — Discovery — 1,1161,116T1110.001 Brute Force: Password Guess…T1110.001 Brute Force: Password Guessing — Credential Access — 711711T1087 Account DiscoveryT1087 Account Discovery — Discovery — 247247T1589 Gather Victim Identity Informat…T1589 Gather Victim Identity Information — Reconnaissance — 244244T1595 Active ScanningT1595 Active Scanning — Reconnaissance — 128128T1505.003 Server Software Component: …T1505.003 Server Software Component: Web Shell — Persistence — 127127T1078 Valid AccountsT1078 Valid Accounts — Initial Access — 103103T1190 Exploit Public-Facing Applicati…T1190 Exploit Public-Facing Application — Initial Access — 3232
Show data table
IDTechniqueTacticEvents
T1595.003Active Scanning: Wordlist ScanningReconnaissance3,865
T1518Software DiscoveryDiscovery3,556
T1595.002Active Scanning: Vulnerability ScanningReconnaissance3,097
T1110.003Brute Force: Password SprayingCredential Access1,382
T1083File and Directory DiscoveryDiscovery1,116
T1110.001Brute Force: Password GuessingCredential Access711
T1087Account DiscoveryDiscovery247
T1589Gather Victim Identity InformationReconnaissance244
T1595Active ScanningReconnaissance128
T1505.003Server Software Component: Web ShellPersistence127
T1078Valid AccountsInitial Access103
T1190Exploit Public-Facing ApplicationInitial Access32

Where the attacks come from

Resolved from the busiest source addresses, which between them account for 54% of all recorded events. Countries are read from the addresses traffic arrives from, which is where it was routed from rather than necessarily where whoever sent it is.

🇬🇧 United Kingdom🇬🇧 United Kingdom — 4,1404,140🇦🇺 Australia🇦🇺 Australia — 362362🇩🇪 Germany🇩🇪 Germany — 227227🇻🇳 Viet Nam🇻🇳 Viet Nam — 120120🇮🇪 Ireland🇮🇪 Ireland — 9090🇯🇵 Japan🇯🇵 Japan — 7171🇸🇬 Singapore🇸🇬 Singapore — 6767
Show data table
ValueEvents
🇬🇧 United Kingdom4,140
🇦🇺 Australia362
🇩🇪 Germany227
🇻🇳 Viet Nam120
🇮🇪 Ireland90
🇯🇵 Japan71
🇸🇬 Singapore67

How far attackers got

Distinct source addresses, counted once each at the deepest level they reached. Every bar contains the ones below it, so the width can only shrink; the drop from one bar to the next is how many stopped at that step.

InformationalInformational — 1,103 sources (100% of all)1,103 (100%)Targeted reconTargeted recon — 1,001 sources (91% of all)1,001 (91%)102 stopped hereLoot huntingLoot hunting — 728 sources (66% of all)728 (66%)273 stopped hereExploitation attemptExploitation attempt — 671 sources (61% of all)671 (61%)57 stopped hereCredential or upload attackCredential or upload attack — 512 sources (46% of all)512 (46%)159 stopped hereCritical — hands-onCritical — hands-on — 36 sources (3% of all)36 (3%)476 stopped here
Show data table
Reached at leastSourcesShareStopped here
Informational1,103100%—
Targeted recon1,00191%102
Loot hunting72866%273
Exploitation attempt67161%57
Credential or upload attack51246%159
Critical — hands-on363%476

Critical events

1 critical event in the last 14 days. Each mark is a day something reached the top of the severity ladder — a canary token fired from off-site, a shell uploaded, a decoy account used. Clusters matter more than the count: several in one day is usually one operator working.

19 Oct20 Oct21 Oct — 1 critical events121 Oct22 Oct23 Oct24 Oct25 Oct26 Oct27 Oct28 Oct29 Oct30 Oct31 Oct1 Nov
Show data table
DayCritical events
19 Oct0
20 Oct0
21 Oct1
22 Oct0
23 Oct0
24 Oct0
25 Oct0
26 Oct0
27 Oct0
28 Oct0
29 Oct0
30 Oct0
31 Oct0
1 Nov0

New and returning sources

Distinct addresses per day. "First time" means never seen before at all, not merely not seen that day. Churn of one-off addresses is ordinary background scanning; addresses that keep coming back are worth a closer look.

  • Seen before
  • First time
0102019 Oct — Seen before: 519 Oct — First time: 71219 Oct20 Oct — Seen before: 520 Oct — First time: 2720 Oct21 Oct — Seen before: 521 Oct — First time: 141921 Oct22 Oct23 Oct24 Oct25 Oct26 Oct27 Oct28 Oct29 Oct30 Oct31 Oct1 Nov
Show data table
DayFirst timeSeen beforeTotal
19 Oct7512
20 Oct257
21 Oct14519
22 Oct000
23 Oct000
24 Oct000
25 Oct000
26 Oct000
27 Oct000
28 Oct000
29 Oct000
30 Oct000
31 Oct000
1 Nov000

Activity by day of the week

A flat week is automation, which does not know what a weekend is. A weekday-shaped week means a person is choosing when to work — the same reading as the hourly chart, at a scale that shows a pattern the hours cannot.

  • Weekday
  • Weekend
08001,600Mon — 1,3721,372MonTue — 1,4131,413TueWed — 1,4771,477WedThu — 1,3061,306ThuFri — 1,3201,320FriSat — 1,3441,344SatSun — 1,1601,160Sun
Show data table
DayEvents
Mon1,372
Tue1,413
Wed1,477
Thu1,306
Fri1,320
Sat1,344
Sun1,160

Busiest source addresses

Addresses are shared, reassigned and often spoofed, so treat these as traffic sources rather than as identities.

80.76.57.1380.76.57.13 — 84684688.97.176.17388.97.176.173 — 60460494.197.234.12394.197.234.123 — 27027086.18.50.10386.18.50.103 — 26726788.97.176.20588.97.176.205 — 26726778.148.64.1678.148.64.16 — 25225285.93.10.24785.93.10.247 — 22722745.150.145.1545.150.145.15 — 21121178.148.77.21078.148.77.210 — 16716784.43.29.21484.43.29.214 — 153153
Show data table
ValueEvents
80.76.57.13846
88.97.176.173604
94.197.234.123270
86.18.50.103267
88.97.176.205267
78.148.64.16252
85.93.10.247227
45.150.145.15211
78.148.77.210167
84.43.29.214153

Most tried usernames

The account names attackers guessed at.

adminadmin — 266266DeployDeploy — 126126jmorrisjmorris — 8888tmalleytmalley — 7070monitormonitor — 4545backupbackup — 3131MonitoringMonitoring — 3030dwhitedwhite — 2929nizeezcinizeezci — 1111rootroot — 1010
Show data table
ValueEvents
admin266
Deploy126
jmorris88
tmalley70
monitor45
backup31
Monitoring30
dwhite29
nizeezci11
root10

Most tried passwords

Taken from the dictionaries currently in circulation. If one of these is familiar, change it.

passpass — 4141password1password1 — 3232adminadmin — 2424Password123Password123 — 181812345678901234567890 — 1717P@ssw0rdP@ssw0rd — 1616P@ssw0rd123P@ssw0rd123 — 1616DeployDeploy — 1414passwordpassword — 1212adminadminadminadmin — 1111
Show data table
ValueEvents
pass41
password132
admin24
Password12318
123456789017
P@ssw0rd16
P@ssw0rd12316
Deploy14
password12
adminadmin11

Updated 2 weeks ago. Source: SparTech Software Honeypot Project. This feed has not reported recently, so the figures may be out of date.