by HawkcrestLive attacks on our honeypot
Updated … · refreshes every 60 s
Same attacks·defense in focus:
Where attacks come from (by country)
Top countries
Source country Symbolic trap
Country-level only, from masked data. Arcs point to a symbolic marker, not the honeypot’s real location. Map: Natural Earth (public domain) via world-atlas.
Attacks per hour (24 h)
Top ports (SIP demoted)
Top passwords tried
Top CRS rule IDs (WAF)
From ModSecurity CRS matches on web attacks. php-bait (:8091) is counted under Face hits, not WAF.
Juice Shop scene
Login & search surface behind ModSecurity CRS on the WAF path.
What they tried to steal (types only)
Decoy types only — never token URLs on this page.
Latest attacks
Click an attack to see what would have caught it. Self-test traffic is labeled so it never looks organic.
| Time (UTC) | Type | Source /24 | Country | Port | Events | Caught by |
|---|