A two-phase experiment exposing a server to the open internet to study automated botnet behaviour. Phase 1 captured raw, unfiltered attack traffic. Phase 2 introduced CrowdSec blocklists to filter out known botnet noise—revealing the novel, sophisticated threats that bypass standard defences.
Real-time login attempt data captured directly from the honeypot. Data is refreshed continuously, updating live as attacks occur.
An analysis of post-exploitation commands executed by attackers who successfully breached default credentials. Commands are ranked by frequency across all captured sessions to reveal common attacker methodologies.
Top attack origins by source IP, resolved locally using MaxMind GeoLite2. This map highlights the novel, sophisticated attacks that successfully bypassed CrowdSec blocklists during Phase 2.