Threat Observatory | Aaron Fillmore

HONEYPOT_ARRAY

What happens when you leave services on the internet

My distributed sensors record network sessions from the open internet. Activity classifications and behavioral context help distinguish different kinds of scanning. This page shows aggregate observations across the deployment.

A session can be a connection probe or an exchange of application data. A classification, scanner identity, or completed connection does not establish successful exploitation. Unknown activity is unclassified.

Workspace classification overview

All 1,080,618 sessions in the 24-hour workspace window, independent of the detail filter.

malicious

6,090

Activity classified as malicious based on observed behavior.

suspicious

20,605

Potential reconnaissance and other suspicious activity.

unknown

979,363

Observed activity that has not received another classification.

benign

74,560

Traffic classified as benign, summarized separately.

Activity details

Showing malicious + suspicious + unknown in the totals, geography, rankings, and timeline below. Benign activity is summarized above.

Window: 2026-10-24 06:00 — 2026-10-25 06:00 UTC

Collected: 2026-10-25 06:00 UTC

Observed sessions

1,006,058

Sessions matching the selected classifications in the 24-hour window.

Unique source IPs

10,000

Distinct source addresses matching the selected classifications.

Activity timeline

Hourly session counts across the latest 168 UTC hour buckets. The current hour is partial.

Hourly activity for malicious + suspicious + unknown
Hour (UTC)	Sessions
2026-10-18T07:00:00.000Z	16508
2026-10-18T08:00:00.000Z	14491
2026-10-18T09:00:00.000Z	13951
2026-10-18T10:00:00.000Z	15222
2026-10-18T11:00:00.000Z	13226
2026-10-18T12:00:00.000Z	13496
2026-10-18T13:00:00.000Z	14257
2026-10-18T14:00:00.000Z	34494
2026-10-18T15:00:00.000Z	13111
2026-10-18T16:00:00.000Z	14341
2026-10-18T17:00:00.000Z	13814
2026-10-18T18:00:00.000Z	13108
2026-10-18T19:00:00.000Z	13218
2026-10-18T20:00:00.000Z	12470
2026-10-18T21:00:00.000Z	12718
2026-10-18T22:00:00.000Z	20102
2026-10-18T23:00:00.000Z	18576
2026-10-19T00:00:00.000Z	16020
2026-10-19T01:00:00.000Z	17463
2026-10-19T02:00:00.000Z	16864
2026-10-19T03:00:00.000Z	19765
2026-10-19T04:00:00.000Z	18268
2026-10-19T05:00:00.000Z	17138
2026-10-19T06:00:00.000Z	17270
2026-10-19T07:00:00.000Z	16720
2026-10-19T08:00:00.000Z	15721
2026-10-19T09:00:00.000Z	16621
2026-10-19T10:00:00.000Z	18970
2026-10-19T11:00:00.000Z	19728
2026-10-19T12:00:00.000Z	14679
2026-10-19T13:00:00.000Z	14777
2026-10-19T14:00:00.000Z	21672
2026-10-19T15:00:00.000Z	47593
2026-10-19T16:00:00.000Z	47675
2026-10-19T17:00:00.000Z	49427
2026-10-19T18:00:00.000Z	48110
2026-10-19T19:00:00.000Z	48518
2026-10-19T20:00:00.000Z	46403
2026-10-19T21:00:00.000Z	47224
2026-10-19T22:00:00.000Z	52237
2026-10-19T23:00:00.000Z	46632
2026-10-20T00:00:00.000Z	11953
2026-10-20T01:00:00.000Z	8195
2026-10-20T02:00:00.000Z	8563
2026-10-20T03:00:00.000Z	7257
2026-10-20T04:00:00.000Z	8276
2026-10-20T05:00:00.000Z	8944
2026-10-20T06:00:00.000Z	9846
2026-10-20T07:00:00.000Z	10592
2026-10-20T08:00:00.000Z	9128
2026-10-20T09:00:00.000Z	9935
2026-10-20T10:00:00.000Z	10648
2026-10-20T11:00:00.000Z	13560
2026-10-20T12:00:00.000Z	14282
2026-10-20T13:00:00.000Z	14330
2026-10-20T14:00:00.000Z	14262
2026-10-20T15:00:00.000Z	11942
2026-10-20T16:00:00.000Z	12673
2026-10-20T17:00:00.000Z	15121
2026-10-20T18:00:00.000Z	16040
2026-10-20T19:00:00.000Z	41562
2026-10-20T20:00:00.000Z	61729
2026-10-20T21:00:00.000Z	56100
2026-10-20T22:00:00.000Z	50672
2026-10-20T23:00:00.000Z	51980
2026-10-21T00:00:00.000Z	52575
2026-10-21T01:00:00.000Z	22033
2026-10-21T02:00:00.000Z	18181
2026-10-21T03:00:00.000Z	17106
2026-10-21T04:00:00.000Z	39285
2026-10-21T05:00:00.000Z	16461
2026-10-21T06:00:00.000Z	14837
2026-10-21T07:00:00.000Z	16555
2026-10-21T08:00:00.000Z	14280
2026-10-21T09:00:00.000Z	14609
2026-10-21T10:00:00.000Z	15932
2026-10-21T11:00:00.000Z	16061
2026-10-21T12:00:00.000Z	14294
2026-10-21T13:00:00.000Z	15291
2026-10-21T14:00:00.000Z	16480
2026-10-21T15:00:00.000Z	16155
2026-10-21T16:00:00.000Z	27228
2026-10-21T17:00:00.000Z	50694
2026-10-21T18:00:00.000Z	49303
2026-10-21T19:00:00.000Z	47062
2026-10-21T20:00:00.000Z	45056
2026-10-21T21:00:00.000Z	46043
2026-10-21T22:00:00.000Z	44620
2026-10-21T23:00:00.000Z	44722
2026-10-22T00:00:00.000Z	46710
2026-10-22T01:00:00.000Z	45289
2026-10-22T02:00:00.000Z	43853
2026-10-22T03:00:00.000Z	43286
2026-10-22T04:00:00.000Z	45167
2026-10-22T05:00:00.000Z	45659
2026-10-22T06:00:00.000Z	43640
2026-10-22T07:00:00.000Z	43504
2026-10-22T08:00:00.000Z	42608
2026-10-22T09:00:00.000Z	44672
2026-10-22T10:00:00.000Z	44440
2026-10-22T11:00:00.000Z	43173
2026-10-22T12:00:00.000Z	45665
2026-10-22T13:00:00.000Z	35490
2026-10-22T14:00:00.000Z	17888
2026-10-22T15:00:00.000Z	10942
2026-10-22T16:00:00.000Z	11795
2026-10-22T17:00:00.000Z	11170
2026-10-22T18:00:00.000Z	10739
2026-10-22T19:00:00.000Z	10925
2026-10-22T20:00:00.000Z	10537
2026-10-22T21:00:00.000Z	11174
2026-10-22T22:00:00.000Z	34725
2026-10-22T23:00:00.000Z	12172
2026-10-23T00:00:00.000Z	10243
2026-10-23T01:00:00.000Z	12258
2026-10-23T02:00:00.000Z	10208
2026-10-23T03:00:00.000Z	10406
2026-10-23T04:00:00.000Z	9684
2026-10-23T05:00:00.000Z	10112
2026-10-23T06:00:00.000Z	9082
2026-10-23T07:00:00.000Z	10730
2026-10-23T08:00:00.000Z	11286
2026-10-23T09:00:00.000Z	14089
2026-10-23T10:00:00.000Z	11637
2026-10-23T11:00:00.000Z	10093
2026-10-23T12:00:00.000Z	9701
2026-10-23T13:00:00.000Z	21351
2026-10-23T14:00:00.000Z	48117
2026-10-23T15:00:00.000Z	45669
2026-10-23T16:00:00.000Z	45947
2026-10-23T17:00:00.000Z	48158
2026-10-23T18:00:00.000Z	44888
2026-10-23T19:00:00.000Z	44309
2026-10-23T20:00:00.000Z	50151
2026-10-23T21:00:00.000Z	47713
2026-10-23T22:00:00.000Z	46712
2026-10-23T23:00:00.000Z	45860
2026-10-24T00:00:00.000Z	47305
2026-10-24T01:00:00.000Z	46381
2026-10-24T02:00:00.000Z	42157
2026-10-24T03:00:00.000Z	118242
2026-10-24T04:00:00.000Z	41772
2026-10-24T05:00:00.000Z	42782
2026-10-24T06:00:00.000Z	43994
2026-10-24T07:00:00.000Z	40977
2026-10-24T08:00:00.000Z	42352
2026-10-24T09:00:00.000Z	41501
2026-10-24T10:00:00.000Z	41963
2026-10-24T11:00:00.000Z	42371
2026-10-24T12:00:00.000Z	42923
2026-10-24T13:00:00.000Z	39924
2026-10-24T14:00:00.000Z	41232
2026-10-24T15:00:00.000Z	39556
2026-10-24T16:00:00.000Z	42764
2026-10-24T17:00:00.000Z	43146
2026-10-24T18:00:00.000Z	44348
2026-10-24T19:00:00.000Z	41787
2026-10-24T20:00:00.000Z	41059
2026-10-24T21:00:00.000Z	40882
2026-10-24T22:00:00.000Z	42287
2026-10-24T23:00:00.000Z	41404
2026-10-25T00:00:00.000Z	41730
2026-10-25T01:00:00.000Z	42996
2026-10-25T02:00:00.000Z	42444
2026-10-25T03:00:00.000Z	40880
2026-10-25T04:00:00.000Z	43228
2026-10-25T05:00:00.000Z	40319
2026-10-25T06:00:00.000Z	0

Source geography

IP geolocation of observed sources. Locations do not establish who is operating a source or whether it can be spoofed.

Top source countries

Top source countries for selected classifications
Country	Sessions
Brazil	874,480
United States	38,430
Netherlands	21,627
Chile	9,711
Singapore	8,115
Germany	6,353
China	5,836
Bulgaria	5,725
Hong Kong	4,624
Poland	3,868

Top destination ports

Ports receiving the most matching sessions. A port number alone does not identify an application.

sessions

Port 443

443,436Port 80

436,431Port 22

18,663Port 0

13,366Port 23

4,713Port 8080

1,943Port 3000

1,355Port 3389

1,066Port 8443

926Port 5900

709

Top destination ports for selected classifications
Port	Sessions
443	443436
80	436431
22	18663
0	13366
23	4713
8080	1943
3000	1355
3389	1066
8443	926
5900	709

Top observed protocols

Protocols identified in matching sessions, including transport and application protocols.

sessions

tcp

989,005ssh

15,586icmp

13,364http

4,091udp

3,678tls

1,050sip

475dns

148snmp

136ntp

112

Top observed protocols for selected classifications
Label	Sessions
tcp	989005
ssh	15586
icmp	13364
http	4091
udp	3678
tls	1050
sip	475
dns	148
snmp	136
ntp	112

Top observed behavior tags

Behavioral and actor tags associated with matching activity.

sessions

SSH Connection Attempt

14,897Matches fingerprint for MikroTik RouterOS

11,442ICMPv4 Protocol

10,841Ping Scanner

10,841Web Crawler

3,541Mirai

2,986Mirai TCP Scanner

2,986Stretchoid

2,838SSH Bruteforcer

1,233Matches fingerprint for Smart TV

1,218

Top observed behavior tags for selected classifications
Label	Sessions
SSH Connection Attempt	14897
Matches fingerprint for MikroTik RouterOS	11442
ICMPv4 Protocol	10841
Ping Scanner	10841
Web Crawler	3541
Mirai	2986
Mirai TCP Scanner	2986
Stretchoid	2838
SSH Bruteforcer	1233
Matches fingerprint for Smart TV	1218

Top tag-associated CVEs

CVEs associated with tags on matching activity. These describe observed behavior, do not establish vulnerabilities in the sensors, and do not prove successful exploitation.

sessions

CVE-2025-29927

863CVE-2025-55182

278CVE-2025-66478

278CVE-2021-23263

152CVE-2025-30208

136CVE-2021-36260

75CVE-1999-0526

33CVE-2021-43798

29CVE-2023-37470

20CVE-2023-38646

Top tag-associated CVEs for selected classifications
Label	Sessions
CVE-2025-29927	863
CVE-2025-55182	278
CVE-2025-66478	278
CVE-2021-23263	152
CVE-2025-30208	136
CVE-2021-36260	75
CVE-1999-0526	33
CVE-2021-43798	29
CVE-2023-37470	20
CVE-2023-38646	20

Rankings show the top results. A session can have multiple protocols, tags, or CVEs, so those counts can overlap. Separately fetched aggregates may differ slightly as new activity is indexed.

Sensor activity

9 sensors observed in the full 24-hour workspace window. Activity counts do not establish sensor health.

Sensor activity across all classifications in the reporting window
Sensor / observed location	Sessions	malicious	suspicious	unknown	benign
Peaceful Beagle India, South Korea, Mexico, United States	886,041	257	592	878,520	6,672
Charming Millipede United Kingdom, Singapore, United States	37,626	484	768	29,551	6,823
Exciting Bat Brazil, Canada, China, Egypt, United Kingdom, Japan, United States	34,250	370	2,609	21,843	9,428
Kind Cougar Germany, Japan, South Korea, United States	30,263	1,670	12,091	7,914	8,588
Friendly Platypus Australia, South Korea, United States	25,038	1,631	740	10,619	12,048
Awesome Hamster Argentina, Canada, China, Germany, Singapore, Taiwan, United States	18,821	374	1,917	10,746	5,784
Nostalgic Bear Brazil, China, Germany, Egypt, Netherlands, Sweden, United States, South Africa	17,992	560	659	6,773	10,000
Nifty Wombat China, Italy, Japan, South Korea, United States	15,613	550	623	6,872	7,568
Blissful Tapir Canada, United Kingdom, Indonesia, South Korea, United States	14,953	194	606	6,508	7,645

Credential data

Credential-attempt data is not collected by this data source.

What's happening

AI-generated interpretation of scanning patterns across the full reporting window, independent of the detail filter. Interpretations are tentative.

The clearest pattern is the dominance of SSH-facing activity: port 22 drew 61.9% of threat sessions, and roughly 14,500 sessions carried an SSH connection-attempt tag, consistent with broad, repeated probing of exposed SSH services rather than targeted web attacks. Malicious and suspicious traffic is also geographically concentrated across the deployment, with a single sensor accounting for 52.1% of threat sessions, suggesting uneven exposure across sensors. Behavior tags tied to Mirai-style scanning and Stretchoid clients appear alongside this SSH volume, though these labels describe observed client behavior, not verified exploitation. Threat volume dipped 9.5% versus the prior comparable window, a modest shift. The remaining 90.7% of sessions remain unclassified and should not be presumed hostile.

Generated 2026-10-25 05:15 UTC · Window 2026-10-24 05:15 — 2026-10-25 05:15 UTC