About this dashboard

What it is

A honeypot is a decoy server that exists only to be attacked. This page shows a cleaned-up, aggregated view of what hits ours. Viewers never connect to the honeypot: it pushes masked summary statistics to Cloudflare, and this page reads only from Cloudflare.

Not a benchmark

The “What would've caught this?” panel lists open-source and public controls only. It is not a benchmark, and no commercial security product is tested or compared.

Data sources

• Suricata with Emerging Threats Open rules.
• ModSecurity with the OWASP Core Rule Set (Apache-2.0).
• VirusTotal detection counts for dropped file hashes, linking to the public report on virustotal.com. We show counts only and do not reproduce per-engine results.
• World map: Natural Earth (public domain), via world-atlas (ISC). Dots are country centroids only.
• Country data: IP Geolocation by DB-IP (CC BY 4.0).

Privacy and masking

Every source IP is masked to its /24 network (for example 203.0.113.0/24). The honeypot's own address, hostnames and admin ports are never published. Times are rounded to the minute. Attacker-supplied text is shortened and shown as plain text.