Threat Observatory | Aaron Fillmore

HONEYPOT_ARRAY

What happens when you leave services on the internet

My distributed sensors record network sessions from the open internet. Activity classifications and behavioral context help distinguish different kinds of scanning. This page shows aggregate observations across the deployment.

A session can be a connection probe or an exchange of application data. A classification, scanner identity, or completed connection does not establish successful exploitation. Unknown activity is unclassified.

Workspace classification overview

All 1,080,618 sessions in the 24-hour workspace window, independent of the detail filter.

malicious

6,090

Activity classified as malicious based on observed behavior.

suspicious

20,605

Potential reconnaissance and other suspicious activity.

unknown

979,363

Observed activity that has not received another classification.

benign

74,560

Traffic classified as benign, summarized separately.

Activity details

Showing malicious + suspicious in the totals, geography, rankings, and timeline below. Benign activity is summarized above.

Window: 2026-10-24 06:00 — 2026-10-25 06:00 UTC

Collected: 2026-10-25 06:00 UTC

Observed sessions

26,695

Sessions matching the selected classifications in the 24-hour window.

Unique source IPs

2,845

Distinct source addresses matching the selected classifications.

Activity timeline

Hourly session counts across the latest 168 UTC hour buckets. The current hour is partial.

Hourly activity for malicious + suspicious
Hour (UTC)	Sessions
2026-10-18T07:00:00.000Z	2072
2026-10-18T08:00:00.000Z	2016
2026-10-18T09:00:00.000Z	2147
2026-10-18T10:00:00.000Z	1917
2026-10-18T11:00:00.000Z	1811
2026-10-18T12:00:00.000Z	1831
2026-10-18T13:00:00.000Z	1788
2026-10-18T14:00:00.000Z	1804
2026-10-18T15:00:00.000Z	1880
2026-10-18T16:00:00.000Z	2236
2026-10-18T17:00:00.000Z	1964
2026-10-18T18:00:00.000Z	1992
2026-10-18T19:00:00.000Z	1896
2026-10-18T20:00:00.000Z	1856
2026-10-18T21:00:00.000Z	2192
2026-10-18T22:00:00.000Z	2103
2026-10-18T23:00:00.000Z	4172
2026-10-19T00:00:00.000Z	2296
2026-10-19T01:00:00.000Z	2307
2026-10-19T02:00:00.000Z	2458
2026-10-19T03:00:00.000Z	2390
2026-10-19T04:00:00.000Z	2583
2026-10-19T05:00:00.000Z	2347
2026-10-19T06:00:00.000Z	2237
2026-10-19T07:00:00.000Z	2288
2026-10-19T08:00:00.000Z	2236
2026-10-19T09:00:00.000Z	2412
2026-10-19T10:00:00.000Z	2504
2026-10-19T11:00:00.000Z	2523
2026-10-19T12:00:00.000Z	2356
2026-10-19T13:00:00.000Z	2167
2026-10-19T14:00:00.000Z	2296
2026-10-19T15:00:00.000Z	1297
2026-10-19T16:00:00.000Z	1398
2026-10-19T17:00:00.000Z	1635
2026-10-19T18:00:00.000Z	1530
2026-10-19T19:00:00.000Z	1450
2026-10-19T20:00:00.000Z	1224
2026-10-19T21:00:00.000Z	1290
2026-10-19T22:00:00.000Z	1378
2026-10-19T23:00:00.000Z	1419
2026-10-20T00:00:00.000Z	1146
2026-10-20T01:00:00.000Z	1253
2026-10-20T02:00:00.000Z	1013
2026-10-20T03:00:00.000Z	1043
2026-10-20T04:00:00.000Z	995
2026-10-20T05:00:00.000Z	1005
2026-10-20T06:00:00.000Z	1596
2026-10-20T07:00:00.000Z	1315
2026-10-20T08:00:00.000Z	1236
2026-10-20T09:00:00.000Z	1362
2026-10-20T10:00:00.000Z	1386
2026-10-20T11:00:00.000Z	1748
2026-10-20T12:00:00.000Z	1515
2026-10-20T13:00:00.000Z	1176
2026-10-20T14:00:00.000Z	1273
2026-10-20T15:00:00.000Z	1194
2026-10-20T16:00:00.000Z	1345
2026-10-20T17:00:00.000Z	1199
2026-10-20T18:00:00.000Z	1149
2026-10-20T19:00:00.000Z	1213
2026-10-20T20:00:00.000Z	3425
2026-10-20T21:00:00.000Z	1143
2026-10-20T22:00:00.000Z	1116
2026-10-20T23:00:00.000Z	1125
2026-10-21T00:00:00.000Z	1201
2026-10-21T01:00:00.000Z	1026
2026-10-21T02:00:00.000Z	1266
2026-10-21T03:00:00.000Z	1283
2026-10-21T04:00:00.000Z	1224
2026-10-21T05:00:00.000Z	1161
2026-10-21T06:00:00.000Z	1295
2026-10-21T07:00:00.000Z	1158
2026-10-21T08:00:00.000Z	1110
2026-10-21T09:00:00.000Z	1154
2026-10-21T10:00:00.000Z	1257
2026-10-21T11:00:00.000Z	1288
2026-10-21T12:00:00.000Z	1329
2026-10-21T13:00:00.000Z	1258
2026-10-21T14:00:00.000Z	1367
2026-10-21T15:00:00.000Z	1306
2026-10-21T16:00:00.000Z	1306
2026-10-21T17:00:00.000Z	1262
2026-10-21T18:00:00.000Z	1423
2026-10-21T19:00:00.000Z	794
2026-10-21T20:00:00.000Z	959
2026-10-21T21:00:00.000Z	882
2026-10-21T22:00:00.000Z	768
2026-10-21T23:00:00.000Z	777
2026-10-22T00:00:00.000Z	909
2026-10-22T01:00:00.000Z	757
2026-10-22T02:00:00.000Z	749
2026-10-22T03:00:00.000Z	868
2026-10-22T04:00:00.000Z	1037
2026-10-22T05:00:00.000Z	793
2026-10-22T06:00:00.000Z	765
2026-10-22T07:00:00.000Z	847
2026-10-22T08:00:00.000Z	746
2026-10-22T09:00:00.000Z	799
2026-10-22T10:00:00.000Z	706
2026-10-22T11:00:00.000Z	850
2026-10-22T12:00:00.000Z	701
2026-10-22T13:00:00.000Z	794
2026-10-22T14:00:00.000Z	761
2026-10-22T15:00:00.000Z	728
2026-10-22T16:00:00.000Z	893
2026-10-22T17:00:00.000Z	766
2026-10-22T18:00:00.000Z	803
2026-10-22T19:00:00.000Z	1084
2026-10-22T20:00:00.000Z	888
2026-10-22T21:00:00.000Z	1549
2026-10-22T22:00:00.000Z	816
2026-10-22T23:00:00.000Z	763
2026-10-23T00:00:00.000Z	738
2026-10-23T01:00:00.000Z	843
2026-10-23T02:00:00.000Z	1174
2026-10-23T03:00:00.000Z	791
2026-10-23T04:00:00.000Z	712
2026-10-23T05:00:00.000Z	1243
2026-10-23T06:00:00.000Z	751
2026-10-23T07:00:00.000Z	748
2026-10-23T08:00:00.000Z	922
2026-10-23T09:00:00.000Z	1169
2026-10-23T10:00:00.000Z	1199
2026-10-23T11:00:00.000Z	1161
2026-10-23T12:00:00.000Z	1192
2026-10-23T13:00:00.000Z	1991
2026-10-23T14:00:00.000Z	1325
2026-10-23T15:00:00.000Z	1345
2026-10-23T16:00:00.000Z	1305
2026-10-23T17:00:00.000Z	1376
2026-10-23T18:00:00.000Z	1247
2026-10-23T19:00:00.000Z	1299
2026-10-23T20:00:00.000Z	1196
2026-10-23T21:00:00.000Z	1213
2026-10-23T22:00:00.000Z	1297
2026-10-23T23:00:00.000Z	1181
2026-10-24T00:00:00.000Z	1291
2026-10-24T01:00:00.000Z	1278
2026-10-24T02:00:00.000Z	1337
2026-10-24T03:00:00.000Z	955
2026-10-24T04:00:00.000Z	891
2026-10-24T05:00:00.000Z	1008
2026-10-24T06:00:00.000Z	1330
2026-10-24T07:00:00.000Z	951
2026-10-24T08:00:00.000Z	938
2026-10-24T09:00:00.000Z	870
2026-10-24T10:00:00.000Z	1098
2026-10-24T11:00:00.000Z	867
2026-10-24T12:00:00.000Z	937
2026-10-24T13:00:00.000Z	1103
2026-10-24T14:00:00.000Z	907
2026-10-24T15:00:00.000Z	952
2026-10-24T16:00:00.000Z	1139
2026-10-24T17:00:00.000Z	947
2026-10-24T18:00:00.000Z	1244
2026-10-24T19:00:00.000Z	1421
2026-10-24T20:00:00.000Z	1037
2026-10-24T21:00:00.000Z	1286
2026-10-24T22:00:00.000Z	1002
2026-10-24T23:00:00.000Z	1096
2026-10-25T00:00:00.000Z	1045
2026-10-25T01:00:00.000Z	1227
2026-10-25T02:00:00.000Z	1155
2026-10-25T03:00:00.000Z	1093
2026-10-25T04:00:00.000Z	1516
2026-10-25T05:00:00.000Z	1535
2026-10-25T06:00:00.000Z	0

Source geography

IP geolocation of observed sources. Locations do not establish who is operating a source or whether it can be spoofed.

Top source countries

Top source countries for selected classifications
Country	Sessions
Brazil	12,261
United States	4,330
Netherlands	3,052
Germany	898
South Korea	875
United Kingdom	621
China	367
France	364
Canada	286
Russia	270

Top destination ports

Ports receiving the most matching sessions. A port number alone does not identify an application.

sessions

Port 22

16,672Port 23

3,584Port 80

1,409Port 443

529Port 8080

504Port 0

284Port 3000

267Port 161

97Port 2323

93Port 8443

Top destination ports for selected classifications
Port	Sessions
22	16672
23	3584
80	1409
443	529
8080	504
0	284
3000	267
161	97
2323	93
8443	47

Top observed protocols

Protocols identified in matching sessions, including transport and application protocols.

sessions

tcp

26,051ssh

15,073http

2,293udp

360icmp

284snmp

83rdp

36tls

26mqtt

21x11

Top observed protocols for selected classifications
Label	Sessions
tcp	26051
ssh	15073
http	2293
udp	360
icmp	284
snmp	83
rdp	36
tls	26
mqtt	21
x11	21

Top observed behavior tags

Behavioral and actor tags associated with matching activity.

sessions

SSH Connection Attempt

14,897Matches fingerprint for MikroTik RouterOS

11,442Mirai

2,986Mirai TCP Scanner

2,986Stretchoid

2,838Web Crawler

2,335SSH Bruteforcer

1,233Matches fingerprint for Smart TV

1,218Recyber Project

945Next.js Authorization Middleware Bypass CVE-2025-29927 Attempt

863

Top observed behavior tags for selected classifications
Label	Sessions
SSH Connection Attempt	14897
Matches fingerprint for MikroTik RouterOS	11442
Mirai	2986
Mirai TCP Scanner	2986
Stretchoid	2838
Web Crawler	2335
SSH Bruteforcer	1233
Matches fingerprint for Smart TV	1218
Recyber Project	945
Next.js Authorization Middleware Bypass CVE-2025-29927 Attempt	863

Top tag-associated CVEs

CVEs associated with tags on matching activity. These describe observed behavior, do not establish vulnerabilities in the sensors, and do not prove successful exploitation.

sessions

CVE-2025-29927

863CVE-2025-55182

278CVE-2025-66478

278CVE-2021-23263

152CVE-2025-30208

136CVE-2021-36260

75CVE-1999-0526

33CVE-2021-43798

29CVE-2023-37470

20CVE-2023-38646

Top tag-associated CVEs for selected classifications
Label	Sessions
CVE-2025-29927	863
CVE-2025-55182	278
CVE-2025-66478	278
CVE-2021-23263	152
CVE-2025-30208	136
CVE-2021-36260	75
CVE-1999-0526	33
CVE-2021-43798	29
CVE-2023-37470	20
CVE-2023-38646	20

Rankings show the top results. A session can have multiple protocols, tags, or CVEs, so those counts can overlap. Separately fetched aggregates may differ slightly as new activity is indexed.

Sensor activity

9 sensors observed in the full 24-hour workspace window. Activity counts do not establish sensor health.

Sensor activity across all classifications in the reporting window
Sensor / observed location	Sessions	malicious	suspicious	unknown	benign
Peaceful Beagle India, South Korea, Mexico, United States	886,041	257	592	878,520	6,672
Charming Millipede United Kingdom, Singapore, United States	37,626	484	768	29,551	6,823
Exciting Bat Brazil, Canada, China, Egypt, United Kingdom, Japan, United States	34,250	370	2,609	21,843	9,428
Kind Cougar Germany, Japan, South Korea, United States	30,263	1,670	12,091	7,914	8,588
Friendly Platypus Australia, South Korea, United States	25,038	1,631	740	10,619	12,048
Awesome Hamster Argentina, Canada, China, Germany, Singapore, Taiwan, United States	18,821	374	1,917	10,746	5,784
Nostalgic Bear Brazil, China, Germany, Egypt, Netherlands, Sweden, United States, South Africa	17,992	560	659	6,773	10,000
Nifty Wombat China, Italy, Japan, South Korea, United States	15,613	550	623	6,872	7,568
Blissful Tapir Canada, United Kingdom, Indonesia, South Korea, United States	14,953	194	606	6,508	7,645

Credential data

Credential-attempt data is not collected by this data source.

What's happening

AI-generated interpretation of scanning patterns across the full reporting window, independent of the detail filter. Interpretations are tentative.

The clearest pattern is the dominance of SSH-facing activity: port 22 drew 61.9% of threat sessions, and roughly 14,500 sessions carried an SSH connection-attempt tag, consistent with broad, repeated probing of exposed SSH services rather than targeted web attacks. Malicious and suspicious traffic is also geographically concentrated across the deployment, with a single sensor accounting for 52.1% of threat sessions, suggesting uneven exposure across sensors. Behavior tags tied to Mirai-style scanning and Stretchoid clients appear alongside this SSH volume, though these labels describe observed client behavior, not verified exploitation. Threat volume dipped 9.5% versus the prior comparable window, a modest shift. The remaining 90.7% of sessions remain unclassified and should not be presumed hostile.

Generated 2026-10-25 05:15 UTC · Window 2026-10-24 05:15 — 2026-10-25 05:15 UTC