HONEYPOT_ARRAY
What happens when you leave services on the internet
My distributed sensors record network sessions from the open internet. Activity classifications and behavioral context help distinguish different kinds of scanning. This page shows aggregate observations across the deployment.
A session can be a connection probe or an exchange of application data. A classification, scanner identity, or completed connection does not establish successful exploitation. Unknown activity is unclassified.
Workspace classification overview
All 272,492 sessions in the 24-hour workspace window, independent of the detail filter.
malicious
1,646
Activity classified as malicious based on observed behavior.
suspicious
15,416
Potential reconnaissance and other suspicious activity.
unknown
207,531
Observed activity that has not received another classification.
benign
47,899
Traffic classified as benign, summarized separately.
Activity details
Showing malicious + suspicious in the totals, geography, rankings, and timeline below. Benign activity is summarized above.
Window: 2026-10-05 22:00 — 2026-10-06 22:00 UTC
Collected: 2026-10-06 22:00 UTC
Observed sessions
17,062
Sessions matching the selected classifications in the 24-hour window.
Unique source IPs
3,128
Distinct source addresses matching the selected classifications.
Activity timeline
Hourly session counts across the latest 168 UTC hour buckets. The current hour is partial.
| Hour (UTC) | Sessions |
|---|---|
| 2026-09-29T23:00:00.000Z | 0 |
| 2026-09-30T00:00:00.000Z | 0 |
| 2026-09-30T01:00:00.000Z | 0 |
| 2026-09-30T02:00:00.000Z | 0 |
| 2026-09-30T03:00:00.000Z | 0 |
| 2026-09-30T04:00:00.000Z | 0 |
| 2026-09-30T05:00:00.000Z | 0 |
| 2026-09-30T06:00:00.000Z | 0 |
| 2026-09-30T07:00:00.000Z | 0 |
| 2026-09-30T08:00:00.000Z | 0 |
| 2026-09-30T09:00:00.000Z | 0 |
| 2026-09-30T10:00:00.000Z | 0 |
| 2026-09-30T11:00:00.000Z | 0 |
| 2026-09-30T12:00:00.000Z | 0 |
| 2026-09-30T13:00:00.000Z | 0 |
| 2026-09-30T14:00:00.000Z | 0 |
| 2026-09-30T15:00:00.000Z | 31 |
| 2026-09-30T16:00:00.000Z | 49 |
| 2026-09-30T17:00:00.000Z | 53 |
| 2026-09-30T18:00:00.000Z | 68 |
| 2026-09-30T19:00:00.000Z | 77 |
| 2026-09-30T20:00:00.000Z | 192 |
| 2026-09-30T21:00:00.000Z | 267 |
| 2026-09-30T22:00:00.000Z | 783 |
| 2026-09-30T23:00:00.000Z | 849 |
| 2026-10-01T00:00:00.000Z | 816 |
| 2026-10-01T01:00:00.000Z | 1276 |
| 2026-10-01T02:00:00.000Z | 823 |
| 2026-10-01T03:00:00.000Z | 963 |
| 2026-10-01T04:00:00.000Z | 862 |
| 2026-10-01T05:00:00.000Z | 900 |
| 2026-10-01T06:00:00.000Z | 814 |
| 2026-10-01T07:00:00.000Z | 883 |
| 2026-10-01T08:00:00.000Z | 1009 |
| 2026-10-01T09:00:00.000Z | 1005 |
| 2026-10-01T10:00:00.000Z | 907 |
| 2026-10-01T11:00:00.000Z | 1367 |
| 2026-10-01T12:00:00.000Z | 1059 |
| 2026-10-01T13:00:00.000Z | 661 |
| 2026-10-01T14:00:00.000Z | 632 |
| 2026-10-01T15:00:00.000Z | 1017 |
| 2026-10-01T16:00:00.000Z | 782 |
| 2026-10-01T17:00:00.000Z | 798 |
| 2026-10-01T18:00:00.000Z | 877 |
| 2026-10-01T19:00:00.000Z | 816 |
| 2026-10-01T20:00:00.000Z | 910 |
| 2026-10-01T21:00:00.000Z | 525 |
| 2026-10-01T22:00:00.000Z | 471 |
| 2026-10-01T23:00:00.000Z | 339 |
| 2026-10-02T00:00:00.000Z | 481 |
| 2026-10-02T01:00:00.000Z | 446 |
| 2026-10-02T02:00:00.000Z | 507 |
| 2026-10-02T03:00:00.000Z | 451 |
| 2026-10-02T04:00:00.000Z | 1070 |
| 2026-10-02T05:00:00.000Z | 571 |
| 2026-10-02T06:00:00.000Z | 405 |
| 2026-10-02T07:00:00.000Z | 410 |
| 2026-10-02T08:00:00.000Z | 434 |
| 2026-10-02T09:00:00.000Z | 427 |
| 2026-10-02T10:00:00.000Z | 496 |
| 2026-10-02T11:00:00.000Z | 631 |
| 2026-10-02T12:00:00.000Z | 591 |
| 2026-10-02T13:00:00.000Z | 605 |
| 2026-10-02T14:00:00.000Z | 746 |
| 2026-10-02T15:00:00.000Z | 628 |
| 2026-10-02T16:00:00.000Z | 552 |
| 2026-10-02T17:00:00.000Z | 724 |
| 2026-10-02T18:00:00.000Z | 558 |
| 2026-10-02T19:00:00.000Z | 629 |
| 2026-10-02T20:00:00.000Z | 493 |
| 2026-10-02T21:00:00.000Z | 580 |
| 2026-10-02T22:00:00.000Z | 451 |
| 2026-10-02T23:00:00.000Z | 429 |
| 2026-10-03T00:00:00.000Z | 580 |
| 2026-10-03T01:00:00.000Z | 612 |
| 2026-10-03T02:00:00.000Z | 683 |
| 2026-10-03T03:00:00.000Z | 481 |
| 2026-10-03T04:00:00.000Z | 547 |
| 2026-10-03T05:00:00.000Z | 458 |
| 2026-10-03T06:00:00.000Z | 631 |
| 2026-10-03T07:00:00.000Z | 611 |
| 2026-10-03T08:00:00.000Z | 358 |
| 2026-10-03T09:00:00.000Z | 581 |
| 2026-10-03T10:00:00.000Z | 569 |
| 2026-10-03T11:00:00.000Z | 552 |
| 2026-10-03T12:00:00.000Z | 579 |
| 2026-10-03T13:00:00.000Z | 1108 |
| 2026-10-03T14:00:00.000Z | 583 |
| 2026-10-03T15:00:00.000Z | 478 |
| 2026-10-03T16:00:00.000Z | 543 |
| 2026-10-03T17:00:00.000Z | 550 |
| 2026-10-03T18:00:00.000Z | 854 |
| 2026-10-03T19:00:00.000Z | 750 |
| 2026-10-03T20:00:00.000Z | 1054 |
| 2026-10-03T21:00:00.000Z | 1028 |
| 2026-10-03T22:00:00.000Z | 877 |
| 2026-10-03T23:00:00.000Z | 591 |
| 2026-10-04T00:00:00.000Z | 571 |
| 2026-10-04T01:00:00.000Z | 760 |
| 2026-10-04T02:00:00.000Z | 760 |
| 2026-10-04T03:00:00.000Z | 873 |
| 2026-10-04T04:00:00.000Z | 706 |
| 2026-10-04T05:00:00.000Z | 713 |
| 2026-10-04T06:00:00.000Z | 613 |
| 2026-10-04T07:00:00.000Z | 639 |
| 2026-10-04T08:00:00.000Z | 575 |
| 2026-10-04T09:00:00.000Z | 596 |
| 2026-10-04T10:00:00.000Z | 807 |
| 2026-10-04T11:00:00.000Z | 1034 |
| 2026-10-04T12:00:00.000Z | 998 |
| 2026-10-04T13:00:00.000Z | 997 |
| 2026-10-04T14:00:00.000Z | 1121 |
| 2026-10-04T15:00:00.000Z | 1041 |
| 2026-10-04T16:00:00.000Z | 1487 |
| 2026-10-04T17:00:00.000Z | 1015 |
| 2026-10-04T18:00:00.000Z | 846 |
| 2026-10-04T19:00:00.000Z | 1012 |
| 2026-10-04T20:00:00.000Z | 980 |
| 2026-10-04T21:00:00.000Z | 1723 |
| 2026-10-04T22:00:00.000Z | 1027 |
| 2026-10-04T23:00:00.000Z | 1099 |
| 2026-10-05T00:00:00.000Z | 1111 |
| 2026-10-05T01:00:00.000Z | 1028 |
| 2026-10-05T02:00:00.000Z | 964 |
| 2026-10-05T03:00:00.000Z | 1355 |
| 2026-10-05T04:00:00.000Z | 982 |
| 2026-10-05T05:00:00.000Z | 884 |
| 2026-10-05T06:00:00.000Z | 917 |
| 2026-10-05T07:00:00.000Z | 834 |
| 2026-10-05T08:00:00.000Z | 899 |
| 2026-10-05T09:00:00.000Z | 1341 |
| 2026-10-05T10:00:00.000Z | 732 |
| 2026-10-05T11:00:00.000Z | 695 |
| 2026-10-05T12:00:00.000Z | 715 |
| 2026-10-05T13:00:00.000Z | 765 |
| 2026-10-05T14:00:00.000Z | 714 |
| 2026-10-05T15:00:00.000Z | 628 |
| 2026-10-05T16:00:00.000Z | 504 |
| 2026-10-05T17:00:00.000Z | 588 |
| 2026-10-05T18:00:00.000Z | 566 |
| 2026-10-05T19:00:00.000Z | 550 |
| 2026-10-05T20:00:00.000Z | 694 |
| 2026-10-05T21:00:00.000Z | 733 |
| 2026-10-05T22:00:00.000Z | 668 |
| 2026-10-05T23:00:00.000Z | 873 |
| 2026-10-06T00:00:00.000Z | 660 |
| 2026-10-06T01:00:00.000Z | 493 |
| 2026-10-06T02:00:00.000Z | 604 |
| 2026-10-06T03:00:00.000Z | 569 |
| 2026-10-06T04:00:00.000Z | 730 |
| 2026-10-06T05:00:00.000Z | 535 |
| 2026-10-06T06:00:00.000Z | 549 |
| 2026-10-06T07:00:00.000Z | 692 |
| 2026-10-06T08:00:00.000Z | 490 |
| 2026-10-06T09:00:00.000Z | 508 |
| 2026-10-06T10:00:00.000Z | 862 |
| 2026-10-06T11:00:00.000Z | 964 |
| 2026-10-06T12:00:00.000Z | 656 |
| 2026-10-06T13:00:00.000Z | 769 |
| 2026-10-06T14:00:00.000Z | 705 |
| 2026-10-06T15:00:00.000Z | 705 |
| 2026-10-06T16:00:00.000Z | 806 |
| 2026-10-06T17:00:00.000Z | 759 |
| 2026-10-06T18:00:00.000Z | 927 |
| 2026-10-06T19:00:00.000Z | 992 |
| 2026-10-06T20:00:00.000Z | 803 |
| 2026-10-06T21:00:00.000Z | 743 |
| 2026-10-06T22:00:00.000Z | 0 |
Source geography
IP geolocation of observed sources. Locations do not establish who is operating a source or whether it can be spoofed.
Top source countries
| Country | Sessions |
|---|---|
| Netherlands | 6,862 |
| Poland | 1,605 |
| United States | 1,248 |
| Türkiye | 1,177 |
| India | 671 |
| Bangladesh | 619 |
| China | 536 |
| Romania | 490 |
| Hong Kong | 474 |
| Brazil | 336 |
Top destination ports
Ports receiving the most matching sessions. A port number alone does not identify an application.
Top destination ports: Ports receiving the most matching sessions. A port number alone does not identify an application.
sessions
| Port | Sessions |
|---|---|
| 22 | 6763 |
| 80 | 2847 |
| 443 | 2458 |
| 23 | 1550 |
| 3000 | 1483 |
| 8443 | 1275 |
| 8080 | 139 |
| 161 | 44 |
| 5555 | 30 |
| 37215 | 15 |
Top observed protocols
Protocols identified in matching sessions, including transport and application protocols.
Top observed protocols: Protocols identified in matching sessions, including transport and application protocols.
sessions
| Label | Sessions |
|---|---|
| tcp | 16992 |
| ssh | 4317 |
| http | 1628 |
| udp | 56 |
| snmp | 44 |
| rdp | 11 |
| icmp | 8 |
| mqtt | 7 |
| smb | 6 |
| mongo | 2 |
Top observed behavior tags
Behavioral and actor tags associated with matching activity.
Top observed behavior tags: Behavioral and actor tags associated with matching activity.
sessions
| Label | Sessions |
|---|---|
| Matches fingerprint for MikroTik RouterOS | 6471 |
| SSH Connection Attempt | 4331 |
| Web Crawler | 1627 |
| Matches fingerprint for AV equipment | 1390 |
| Generic Sensitive File Access Attempt | 1370 |
| Mirai | 1153 |
| Mirai TCP Scanner | 1153 |
| Matches fingerprint for Smart TV | 825 |
| Matches fingerprint for embedded FTP/SSH Appliance | 715 |
| SSH Bruteforcer | 230 |
Top tag-associated CVEs
CVEs associated with tags on matching activity. These describe observed behavior, do not establish vulnerabilities in the sensors, and do not prove successful exploitation.
Top tag-associated CVEs: CVEs associated with tags on matching activity. These describe observed behavior, do not establish vulnerabilities in the sensors, and do not prove successful exploitation.
sessions
| Label | Sessions |
|---|---|
| CVE-2025-29927 | 98 |
| CVE-2026-0770 | 48 |
| CVE-2021-36260 | 28 |
| CVE-2021-23263 | 22 |
| CVE-2025-30208 | 16 |
| CVE-1999-0526 | 8 |
| CVE-2026-28414 | 6 |
| CVE-2024-29291 | 5 |
| CVE-2021-27905 | 4 |
| CVE-2025-59528 | 4 |
Rankings show the top results. A session can have multiple protocols, tags, or CVEs, so those counts can overlap. Separately fetched aggregates may differ slightly as new activity is indexed.
Sensor activity
6 sensors observed in the full 24-hour workspace window. Activity counts do not establish sensor health.
| Sensor / observed location | Sessions | malicious | suspicious | unknown | benign |
|---|---|---|---|---|---|
| Charming Millipede Australia, China, Spain, Italy, Japan, Singapore, Taiwan, United States | 129,661 | 211 | 6,535 | 115,452 | 7,463 |
| Awesome Hamster Australia, Switzerland, China, Germany, France, Indonesia, Japan, South Korea, United States | 49,889 | 174 | 3,613 | 40,189 | 5,913 |
| Exciting Bat China, Germany, United Kingdom, Italy, Netherlands, Thailand, United States | 30,797 | 507 | 3,357 | 19,763 | 7,170 |
| Peaceful Beagle China, Germany, Spain, France, India, Netherlands, United States, South Africa | 26,677 | 335 | 224 | 18,845 | 7,273 |
| Blissful Tapir China, Germany, Ghana, South Korea, Saudi Arabia, United States | 17,876 | 328 | 261 | 6,925 | 10,362 |
| Kind Cougar China, Colombia, United States | 17,670 | 91 | 1,429 | 6,425 | 9,725 |
Credential data
Credential-attempt data is not collected by this data source.
What's happening
AI-generated interpretation of scanning patterns across the full reporting window, independent of the detail filter. Interpretations are tentative.
Threat activity in this window is dominated by SSH-focused probing: port 22 accounted for 39.6% of malicious and suspicious sessions, and SSH connection attempts were the most common behavior tag, a pattern consistent with broad automated scanning of remote-access services rather than targeted intrusion. Mirai-associated tags appear on a sizable share of that activity, suggesting reuse of well-known scanner tooling, though such labels reflect observed fingerprints, not verified exploits. Threat sessions declined about 16% from the previous comparable window, with hourly volume spread evenly rather than concentrated in bursts. The remaining traffic was overwhelmingly unclassified, so hostile intent cannot be assumed for it.
Generated 2026-10-06 22:00 UTC · Window 2026-10-05 22:00 — 2026-10-06 22:00 UTC