Traffic is dominated by passive sensor capture, but the two streams move independently — a spike in sensor volume is not a spike in actual engagement.
The red layer is real interaction with emulated services. The blue layer is packet-level observation (P0f fingerprinting, Suricata flows, Fatt). They diverge: sensor volume spikes on scan sweeps that never complete a service handshake.
Rows are 27 Oct – 1 Nov, columns are UTC hours. Peaks cluster at 23:00 and 02:00 UTC; the quietest band is 12:00–13:00. Because UTC aligns roughly with European night and US evening, the trough is consistent with Western infrastructure quieting while Asian sources continue.
Yellow is known measurement/scanner ASNs (Google, Censys, ONYPHE, Modat, Shadowserver…). The band is remarkably flat — these are machines on schedules, immune to time of day.
Event volume against distinct IPs per country. The two bars track each other almost perfectly (r=+0.96), meaning big numbers mean many sources, not one loud host.
Excluding RFC1918 and known scanner infrastructure leaves 71,941 genuine engagement events from 5,852 IPs — 5% of the corpus, and the only part worth threat-hunting against.
Bubble area is event volume, positioned at each country's centroid; hover for counts. Operator/admin traffic is excluded.
Offline vector basemap (Natural Earth 110m land) — no external tile requests.
The bundled reputation list tags most traffic as scan source or bad reputation. A small but meaningful tail is explicitly compromised or attack source — those are the hosts you would prioritise.
X = unique IPs, Y = events per IP, bubble = total volume. The upper-left region is the dangerous quadrant: few sources, heavy engagement. RDP and Heralding live there.
SMB dominates raw volume, but the ordering changes when you count only traffic that reached a listening honeypot — port 443's huge sensor count collapses to almost nothing.
Blue = all observed traffic, green = traffic that actually reached an interactive honeypot. Port 443 is mostly scan noise: 107,744 sensor hits become 1,531 real ones.
Cross-tab of destination port against source ASN. Strong cells reveal specialisation — commodity scanners spread evenly, while specific networks concentrate on one service.
The credential corpus is commodity IoT stuffing — blank, "1", "123", "password". There is no evidence of targeted or credential-specific campaigns.
Blank-password attempts dominate. sa and admin lead usernames — classic MSSQL/edge-device targeting.
Events (red) against distinct source IPs (cyan). The gap between the lines is the story: volume rises while source count stays flat — persistence, not breadth (r=+0.11).
Mostly off-the-shelf tooling: zgrab, CensysInspect, GenomeCrawlerd, and one explicitly labelled Go Web Pentest Tool.
How many distinct days each source IP appeared, among the 2,000 highest-volume IPs. The red bars are hosts present on 5–6 of 6 days — sustained campaigns, not drive-bys.
1, 123, password. Nobody is guessing
your specific credentials; the same short list is thrown at everything with a
login prompt. RDP is the exception in intensity, not sophistication: 93 source
IPs produced 11,420 events, and the mstshash=hello cookie in 4,298
payloads is the fingerprint of a small number of brute-force tools run
persistently. Persistence matters more than volume — the hosts present on 5–6
of 6 days are the ones actually worth blocking.134,791 events carry an alert signature, but severity is skewed low and the top signature is a known false-positive magnet.
"Misc Attack" and "Generic Protocol Command Decode" dominate — the fingerprints of scanning rather than exploitation.
Only a small fraction is severity 1. Caveat: the top signature, "DoublePulsar Backdoor installation" (16,668), fires on ordinary SMB scanning and is almost certainly a false positive.
Each card pairs a technique seen in this corpus with the ports and evidence behind it, then states the consequence if the same attack reached a real system instead of an emulation.
Automated sweeps across IPv4 space looking for anything that answers. Individually harmless, but it is the reconnaissance layer that feeds every other attack here.
37.9% of external traffic originates from known scanner/measurement ASNs.
Attempts against Windows file-sharing flaws — the EternalBlue lineage — plus credential relay and SMB signing abuse.
Loudest port in the corpus. Suricata fired DoublePulsar and DShield-blocklist signatures here, though DoublePulsar is likely a false positive.
Sustained password guessing against Remote Desktop, driven by a small set of persistent hosts rather than a broad sweep.
123 events per source IP — the highest depth of any service.
The mstshash=hello cookie appears in 4,298 payloads.
Replaying the IoT default-credential canon against anything with a login
prompt: sa, admin, root with blank,
1, 123.
2,273 credential documents captured. Low sophistication, high volume.
Tricking a server-side request into fetching the instance metadata service, in the hope of reading temporary credentials.
Top requested URLs here are
/latest/meta-data/iam/security-credentials/ and
/latest/api/token — not web shells.
Using the host as a relay to launder traffic and to check its own egress
identity via icanhazip.com and api.ipinfo.io.
958 Suricata alerts for inbound CONNECT on an off-port.
Probing for vulnerable WordPress plugins, exposed configuration files, and injectable parameters.
/wp-login.php, /xmlrpc.php,
/.env (130 hits), plus a specific malicious host
a7x.overflow.biz.
.env hands over database and API
credentials.Default credentials and unauthenticated access against common data stores, reached through Dionaea, Redishoneypot and Heralding.
MySQL 6,204 · MSSQL 4,805 · Redis 233 · MongoDB 214 · PostgreSQL 18.
Enumeration of industrial controllers, utility meters and out-of-band management interfaces, caught by the ConPot family.
Kamstrup meters, IEC 60870-5-104, SNMP and IPMI all received traffic.
Exploiting devices that are rarely patched and usually trusted inside the network: printers, medical systems, Android debug bridges.
Miniprint 220 · IPPhoney 14 · Dicompot 59 · Medpot 2 · Adbhoney 140.
Hunting for VNC servers with no authentication or a trivially weak password.
RFB 003.003 and 003.008 handshakes captured in payload snippets.
Targeting internet-facing VPN concentrators, a favoured entry point because a win bypasses the perimeter entirely.
266 events from 80 distinct sources, including a live attempt to tunnel to an external host.
/latest/meta-data/iam/security-credentials/,
/latest/api/token and
/latest/meta-data/managed-ssh-keys/active-keys/ubuntu/ hundreds of
times each. Combined with the honeypot being used as an open CONNECT proxy
(icanhazip.com, api.ipinfo.io), it indicates actors
who treat any exposed host as a pivot into the surrounding cloud account
rather than a target in itself.A honeypot is a decoy: it emulates a real service so attackers reveal their technique, tooling and intent without touching production. Each card states what the service imitates, what it actually captures, and what a successful attack on that service would mean if it were real.
Emulates a Linux shell with a fake filesystem. Captures credential stuffing and, more usefully, what attackers do after login — commands typed, files fetched, payloads uploaded.
Emulates a spread of vulnerable services and captures the actual malware dropped against them, storing binaries for analysis.
Emulates Windows Remote Desktop and captures client hostnames, usernames, and connection fingerprints.
Emulates many login protocols purely to harvest username/password pairs — it is a credential collector, not a full service.
Emulates industrial controllers and utility meters. Captures reconnaissance aimed at operational technology.
Snare serves cloned real web pages with hidden attack surface; Tanner emulates a deliberately vulnerable app and grades the sophistication of each attack.
Emulate HTTPS services and an anti-money-laundering API respectively. Capture request patterns, SSRF attempts and scanner fingerprints.
Mailoney emulates a mail server and Sentrypeer a SIP registrar. They capture relay abuse, spam tooling and toll-fraud attempts.
Emulate network printers. Capture print-job exploitation — a perennially forgotten foothold inside trusted subnets.
Emulate clinical messaging and medical imaging protocols. Capture healthcare-targeted reconnaissance.
Emulate commonly misconfigured data stores. Capture unauthenticated access attempts.
Emulate Android debug bridges, WordPress sites and Cisco VPN appliances — three very different routes into a network.
A low-interaction listener that accepts connections on dozens of ports without emulating any of them. Captures breadth, not behaviour.
Ranked by behaviour rather than volume — multi-service engagement, persistence across days, and real credential or exploit attempts. Known measurement networks (Censys, ONYPHE, Google) are excluded: they scan everything and target nothing.
77.90.185.30DE · GermanyHammered MySQL on 3306 for five straight days and produced 345 credential documents — admin, root and sa, almost all with a blank password. Pure default-credential playbook, and simultaneously tagged on the Spamhaus and DShield blocklists.
FILE privileges, MySQL also allows arbitrary file write on the host — which converts directly to code execution.45.138.12.48LT · LithuaniaExclusively a web attacker. Tripped signatures for React2Shell (React Server Components RCE), JavaScript prototype pollution, and X-Client-IP header spoofing aimed at bypassing localhost-only restrictions. This is current, specific exploit code — not a generic sweep.
172.213.246.51IT · Milan1,628 RDP events across 814 distinct sessions on port 3389 over three days. Carries no reputation label at all, and resolves to Microsoft's ASN — either a compromised Azure tenant or a testing harness.
204.76.203.221NL · EygelshovenPresent every single day of the collection window. Probed the ConPot Guardian AST interface on 10001 plus a rotating set of high ports, and triggered inbound HTTP CONNECT on an off-port — an attempt to use the host as a relay. Listed on Spamhaus DROP.
18.218.118.203US · Columbus, OhioA genuine multi-protocol sweeper: opened real Cowrie and RDP honeypot sessions and touched MySQL, PostgreSQL, VNC and ConPot. Reverse DNS is the giveaway — it PTRs to scan.visionheight.com, and five addresses in this corpus share that name. It is one commercial scanning service rotating across AWS addresses, not five separate actors.
3.129.187.38US · Columbus, OhioAimed almost entirely at non-standard ports — 30001, 8003, 5938, 4449, 7000, 1025, 1723 — plus Elasticsearch on 9200. Triggered ElasticPot recon, IPP and a Cowrie key exchange. Same PTR as the card above (scan.visionheight.com): one operator running two different probes from the same fleet.
204.76.203.4NL · EygelshovenThe highest-volume address in this set: 7,859 events sprayed across random high ports, 1,244 Honeytrap captures, and the only Dicompot hit of the group. PTRs to pfcloud.network, as do all six active addresses in 204.76.203.0/24 — one leased block, rotated through substitutes.
scan.visionheight.com, a string that also appears as a user agent
elsewhere in this corpus — and two more PTR into pfcloud.network,
alongside all six active addresses in 204.76.203.0/24. Blocking a
single IP is therefore close to pointless: the address changes, the netblock and
the domain do not. Block the /24 or the ASN, and expect the operator to move
provider within days. That churn is also why per-IP reputation feeds go stale
faster than they are updated.Reverse DNS on the 500 highest-volume addresses (359 resolved) collapses thousands of individual IPs into a handful of organisations. The same happens with TLS fingerprints.
Addresses grouped by PTR domain and by /24. A cluster needs at least two addresses. Measurement badges mark commercial scan and threat-intel services; operator badges mark hosts that are not scanning-as-a-product.
| cluster | kind | IPs | events | days | attribution |
|---|---|---|---|---|---|
| onyphe.net | PTR domain | 55 | 21,860 | 6/6 | measurement ONYPHE SAS |
| modat.io | PTR domain | 47 | 107,872 | 6/6 | measurement Modat B.V. |
| censys-scanner.com | PTR domain | 44 | 31,851 | 6/6 | measurement Censys, Inc. |
| visionheight.com | PTR domain | 19 | 28,738 | 6/6 | operator Amazon.com, Inc. |
| pfcloud.network | PTR domain | 12 | 18,729 | 6/6 | operator Pfcloud UG (haftungsbeschrankt) |
| deepfield.net | PTR domain | 8 | 4,289 | 3/6 | measurement Google LLC |
| criminalip.com | PTR domain | 7 | 5,157 | 6/6 | measurement IP Volume inc |
| 85.217.140.0/24 | /24 | 45 | 107,201 | 6/6 | measurement Modat B.V. |
| 167.94.146.0/24 | /24 | 31 | 29,029 | 6/6 | measurement Censys, Inc. |
| 195.184.76.0/24 | /24 | 19 | 6,477 | 6/6 | measurement ONYPHE SAS |
| 91.231.89.0/24 | /24 | 16 | 7,422 | 6/6 | measurement ONYPHE SAS |
| 204.76.203.0/24 | /24 | 12 | 18,729 | 6/6 | operator Pfcloud UG (haftungsbeschrankt) |
| 91.230.168.0/24 | /24 | 12 | 4,594 | 6/6 | measurement ONYPHE SAS |
| 216.180.246.0/24 | /24 | 8 | 4,289 | 3/6 | measurement Google LLC |
| 91.196.152.0/24 | /24 | 8 | 3,367 | 6/6 | measurement ONYPHE SAS |
| 66.132.195.0/24 | /24 | 8 | 1,721 | 5/6 | measurement Censys, Inc. |
| 185.242.226.0/24 | /24 | 7 | 5,157 | 6/6 | measurement IP Volume inc |
| 45.82.78.0/24 | /24 | 7 | 2,879 | 6/6 | operator Detai Prosperous Technologies Li |
| 77.91.71.0/24 | /24 | 5 | 1,913 | 6/6 | operator Alferov Aleksey Aleksandrovich |
A TLS fingerprint identifies the client library, not the attacker. 853 different IPs share one JA4 — evidence that per-IP counting measures proxy churn, not adversaries.
How much of each fingerprint space the top ten values cover. JA3 is nearly one-per-connection and useless for grouping; JA4 normalises away version noise and clusters properly.
visionheight.com (19 IPs),
pfcloud.network (12), and two single-purpose ranges —
45.82.78.0/24 and 77.91.71.0/24, the latter registered
to an individual's name, which is the usual shape of bulletproof hosting.
Of 2,029 Cowrie sessions, only 57 ended in a successful login and 48 ran any command. This is the rare part of the corpus where attackers stopped scanning and started acting.
Only commodity pairs got in — the same list that is rejected everywhere else. Nothing here suggests a targeted guess.
| username | password | wins |
|---|---|---|
| admin | 1234567890 | 4 |
| admin | pass | 3 |
| root | (blank) | 3 |
| root | debian | 3 |
| ximo | (blank) | 2 |
| administrator | administrator | 2 |
| root | 00000000 | 2 |
| root | 123456 | 2 |
Login success is not concentrated: the top source won four times, and the rest are singletons. These are individual compromised hosts, not a coordinated fleet.
All four are cryptocurrency-mining droppers. Two masquerade as
sshd, one as xinetd — daemons that start
automatically on a real host. Verdicts below are VirusTotal API results.
| file | VirusTotal verdict | engines | type |
|---|---|---|---|
| .b0s | trojan.processhider/rootkit | 36/75 | ELF, 1.6 MB |
| xinetd | miner.elf64/lhayep | 35/75 | ELF, 28.8 MB |
| sshd | trojan.multiverze/malxmr | 37/75 | ELF, 864.0 KB |
| sshd | miner.multiverze/r002c0ddr26 | 37/75 | ELF, 28.3 MB |
Each upload traces to a session, and every session logged in with the same weak root credential. Attribution from source IP, ASN and reverse DNS.
| uploader | organisation | location | login | file | date |
|---|---|---|---|---|---|
| 2.57.122.76 | Unmanaged Ltd | RO | root/password | .b0s | 2026-10-28 |
| 111.68.111.100 | PERN AS Content Servie Provider, I hamdard.edu.pk | PK / Karachi | root/debian | xinetd | 2026-10-31 |
| 115.190.225.133 | Beijing Volcano Engine Technology | CN | root/debian | sshd | 2026-10-31 |
| 128.14.232.142 | UCLOUD INFORMATION TECHNOLOGY (HK) | US / Los Angeles | root/debian | sshd | 2026-11-01 |
root with the password debian; the
fourth used root with password. The payloads spread
onward the same way, which is how a mining botnet grows: scan for SSH, guess a
default credential, drop a 28 MB miner, detach it with
nohup, move on. Two uploaders sit in Chinese cloud providers
(ByteDance's Volcano Engine and UCLOUD) and carry
ssh abuse and compromised labels, meaning they are
themselves victims being used as staging. The Pakistani uploader resolves to
hamdard.edu.pk, a university hostname — the kind of unpatched
campus server these botnets depend on.enable → config terminal → system →
linuxshell → su → shell → sh
— and then stopped. That sequence is one script trying every known route to a
shell on any device type, not a human working a target. A second pattern
is more careful: one session ran 44 commands built around
check_<hash>_small_math (evaluating
$((885*889+62))), _small_pid and
_small_positional — a harness proving the shell really executes and
returns output before committing. And a third wrote hidden .x files
into /var/run, /mnt, /usr and
/dev to find a writable directory for staging.