Field notes from running honeypot sensors at scale.
2026-07-10
In late June, 38 Google Cloud machines fired 1.87 million requests guessing the filenames of leaked database dumps. By IP and HTTP fingerprint they looked like 11,000 unrelated scanners; by TLS fingerprint they were a single operation. A field lesson in attributing coordinated cloud activity at the layer that actually holds.
2026-07-08
CVE-2026-34197 (KEV) probed by 421 IPs; port 33 lit up with 179,369 events. Most-hit ports, exploit paths to grep your logs for, and delivered malware. 2,710,022 events from 25,986 IPs, June 29 to July 5, 2026.
2026-06-24
Nobody's exploiting you. They're reading your .git/config.
2026-06-17
Almost every IP we logged exploiting the Gravity SMTP credential bug shares one HTTP fingerprint. Behind it is a Google Cloud fleet of thousands of short-lived instances, disguised by 3,299 rotating user-agents, sweeping more than 36,000 ports for .env files, git configs, credentials, and database dumps.
2026-06-04
Added header search to the lookup tool. One query over the forwarding headers turns up a localhost-bypass farm hunting .env files, Log4Shell still smuggled into X-Forwarded-For, and scanners leaking their own internal IPs.
2026-05-31
A client fingerprint is reused even as an operation rotates its IPs. Measuring how concentrated each fingerprint is across networks and ports turns a manual hunt into a live page. Among the thirteen it surfaces is the Viettel SSH botnet we mapped by hand earlier.
2026-05-29
A single attacking IP tells you little. The back end it pulls its payload from, and the client fingerprint it presents, are the parts operators reuse. Correlating both across the sensor network collapses internet noise into discrete operations: one cluster of 1,001 IPs across 306 networks and 64 countries, tied to eight shared staging servers and a single TLS and HTTP fingerprint that appears nowh
2026-05-28
Three weeks of one Dutch ASN sending 3,861 hits at Anthropic-proxy paths. Port 11434 (Ollama) holding 50-80 distinct source IPs per week since March. A single 45-minute sweep from one IP that lists credential paths for Claude, Codex, Gemini, DeepSeek, DashScope, AWS, Azure, Docker, and shell history.
2026-05-28
A short tour of what we run, what is in the dataset, and what we plan to write about here.
The weekly threat report
One email every Monday: port movers, KEV and recent CVE probes with live counts, and the attack paths worth grepping your own logs for. Here is a real issue.
Double opt-in: we send one confirmation email and nothing else until you click it. Unsubscribe in one click, any time.