Honeypot Stats (updated hourly)

Event volume by severity

Last 14 days. Tall pale bars are ordinary background scanning; dark segments are attempts that carried credentials or a payload.

• Recon (sev 1-2)
• Loot hunting (sev 3)
• Attack (sev 4-5)
• Critical (sev 6)

Severity mix

The scale measures engagement depth. 1-2 is recon, 3 is hunting for loot, 4 is an exploit being attempted, 5 is an attack on the login or upload surface, and 6 means somebody acted on what they took.

Activity by hour of day

Flat coverage across all 24 hours is the signature of automation. Humans cluster into working hours, and the shaded band is the stretch nobody is choosing to work through.

• Daytime and evening
• Small hours (00:00-05:59)

Top event types

What the honeypot caught people doing, counted over everything it has recorded.

Attacker tooling

The software making the requests, identified from how each client presents itself. Commodity scanners dominate; anything hand-driven stands out.

Most common attacks

Each label is one recognised technique or vulnerable endpoint.

Where the attacks come from

Resolved from the busiest source addresses, which between them account for 77% of all recorded events. Countries are read from the addresses traffic arrives from, which is where it was routed from rather than necessarily where whoever sent it is.

How far attackers got

Distinct source addresses, counted once each at the deepest level they reached. Every bar contains the ones below it, so the width can only shrink; the drop from one bar to the next is how many stopped at that step.

Critical events

1 critical event in the last 14 days. Each mark is a day something reached the top of the severity ladder — a canary token fired from off-site, a shell uploaded, a decoy account used. Clusters matter more than the count: several in one day is usually one operator working.

New and returning sources

Distinct addresses per day. "First time" means never seen before at all, not merely not seen that day. Churn of one-off addresses is ordinary background scanning; addresses that keep coming back are worth a closer look.

• Seen before
• First time

Activity by day of the week

A flat week is automation, which does not know what a weekend is. A weekday-shaped week means a person is choosing when to work — the same reading as the hourly chart, at a scale that shows a pattern the hours cannot.

• Weekday
• Weekend

Busiest source addresses

Addresses are shared, reassigned and often spoofed, so treat these as traffic sources rather than as identities.

Most tried usernames

The account names attackers guessed at.

Most tried passwords

Taken from the dictionaries currently in circulation. If one of these is familiar, change it.