Everything the sensors have recorded
What you would be buying, counted. Our sensors answer as exposed servers across the internet and keep what unsolicited traffic does to them: the request, the body, the file it tried to drop, the credentials it sprayed and the fingerprint of the client that sent it.
Breakdowns measured 27 October 2026 over 30 complete days. The headline figures are live.
... of them arrived in the last 24 hours
The ports that get knocked on
Ports by traffic over 30 days, with the number of distinct addresses behind it. The two counts disagree on purpose: one loud host moves the probes column and not the addresses column.
| Port | What answers | Probes | Addresses |
|---|---|---|---|
| 39131 | unassigned, swept as a pair with 39132 | 893,907 | 3,847 |
| 443 | HTTPS | 246,537 | 4,889 |
| 80 | HTTP | 232,977 | 3,937 |
| 22 | SSH | 188,582 | 3,294 |
| Port | What answers | Probes | Addresses |
|---|---|---|---|
| 445 | SMB | 134,841 | 7,939 |
| 1433 | Microsoft SQL Server | 77,733 | 3,827 |
| 3 | unassigned, low-port sweep | 75,465 | 241 |
| 10 | unassigned, low-port sweep | 74,487 | 245 |
The protocols on the wire
Application protocols recognised over 30 days, by probes and by the addresses that spoke them. SSH and RDP carry fewer addresses than SMB and far more attempts each.
| Protocol | Probes | Addresses |
|---|---|---|
| HTTP | 4,328,703 | 37,967 |
| SSH | 957,832 | 6,197 |
| BitTorrent | 895,605 | 4,086 |
| RDP | 589,953 | 4,178 |
| Protocol | Probes | Addresses |
|---|---|---|
| HTTP proxy | 543,792 | 891 |
| TLS | 147,332 | 5,825 |
| SOCKS5 | 95,524 | 1,162 |
| MSSQL TDS | 85,495 | 4,968 |
The countries it comes from
By distinct source addresses over 30 days, which is the ordering that holds: ranking by probes would put one busy network above a country sending thousands of separate hosts.
| Country | Addresses | Probes |
|---|---|---|
| United States | 20,149 | 1,947,378 |
| China | 7,413 | 583,841 |
| Belgium | 3,457 | 39,848 |
| United Kingdom | 2,513 | 489,426 |
| Country | Addresses | Probes |
|---|---|---|
| Germany | 2,342 | 1,620,599 |
| India | 1,747 | 92,691 |
| Singapore | 1,370 | 59,344 |
| The Netherlands | 1,207 | 1,108,209 |
The method behind these numbers
Stated so you can check them, and so the ones that cannot be checked are visible as such.
The window
Thirty complete days. Both edges of a bucketed series are unsettled, so a partial first or last day is dropped rather than drawn.
The population
Unsolicited traffic reaching sensors that answer as exposed servers. It is not a sample of the internet, and it is not traffic anyone asked for.
Addresses, not people
A distinct address overcounts one operator rotating hosts and undercounts a network behind one address. Treat it as an ordering, not a census.
Two columns on purpose
Probes and addresses are reported side by side everywhere, because one loud host moves the first and not the second.
Nothing about the sensors
Not how many there are, not where they sit, not when any of them started. That is deliberate.
Check any of it
Every figure has a page behind it, and ?format=json on that page returns the same numbers as a document you can diff.
Query it before you decide anything
A free key takes a minute, needs no card and runs 500 queries a day. The public feeds need no account at all.