txcyber.net — honeypot sensor · lab.txcyber.net

Attacks

Live hits on our own honeypot sensor, lab.txcyber.net. It is a decoy: a machine that runs fake SSH, Telnet, web, database and other services and hosts nothing real. No one has a legitimate reason to connect to it, so everything below is a scan, a password-guessing run or an exploit attempt from somewhere on the internet. While this page is open it asks the sensor for new events every 10 seconds.

Activesensor lab.txcyber.net2,081 events · 24h111 sources1,352 interactivelast hit 8 min agochecked 10:32:39 pm CSTchecks every 10s

trace --live * → lab.txcyber.net

remote loginwebexposed serviceprobeinteractiveEach arc is a real hit, drawn from the source country to the sensor, a few seconds after it happened. Circles grow with hits from that country.

tail -f lab.txcyber.net/attacks.log

  1. 147.185.132.22LDAP:389United States
  2. 42.113.165.199Telnet:23Vietnaminteractive
  3. 77.239.124.252Telnet:23 ×44 · 2mUnited Kingdominteractive
  4. 185.226.93.242Hikvision camera:8080United States
  5. 128.199.97.232SSH:22 ×2 · 3mSingaporeinteractive
  6. 92.118.39.50SSH:22Switzerlandinteractive
  7. 79.124.58.218Hikvision camera:8080Bulgaria
  8. 45.198.224.125Hikvision camera:8080South Africa
  9. 45.79.181.104MySQL:3306 ×2 · 1sUnited Statesinteractive
  10. 195.178.110.78Telnet:23 ×14 · 32sRomaniainteractive
  11. 13.72.73.58Telnet:23United Statesinteractive
  12. 147.185.132.150SSH:22United Statesinteractive
  13. 195.182.16.23Hikvision camera:8080France
  14. 220.82.215.158Telnet:23South Koreainteractive
  15. 79.124.58.218ESXi:8081 ×2 · 9s +1 moreBulgaria
  16. 172.202.106.156MySQL:3306United Statesinteractive
  17. 122.155.132.40Telnet:23Thailandinteractive
  18. 92.118.39.75SSH:22 ×16 · 34mSwitzerlandinteractive
  19. 218.155.196.217Telnet:23South Koreainteractive
  20. 61.218.153.56Telnet:23Chinainteractive
  21. 79.124.58.218MySQL:3306Bulgariainteractive
  22. 18.116.101.220Hikvision camera:8080 ×2 · 41sUnited States
  23. 77.239.124.45SSH:22 ×502 · 24hUnited Kingdominteractive
  24. 166.62.102.109Telnet:23United Statesinteractive
  25. 77.239.124.252Telnet:23 ×44 · 2mUnited Kingdominteractive
  26. 177.236.70.228Telnet:23Mexicointeractive
  27. 36.255.97.39Telnet:23Philippinesinteractive
  28. 36.255.97.152MySQL:3306Philippinesinteractive
  29. 64.89.160.111Hikvision camera:8080United States
  30. 175.107.237.198Telnet:23 ×22 · 5mPakistaninteractive
  31. 77.239.124.252Telnet:23 ×220 · 24hUnited Kingdominteractive
  32. 77.90.185.29SSH:22Germanyinteractive
  33. 74.82.47.4Hikvision camera:8080 ×2 · 5mUnited States
  34. 74.82.47.56Hikvision camera:8080United States
  35. 74.82.47.24Hikvision camera:8080United States
  36. 45.198.224.125WordPress:9090South Africa
  37. 74.82.47.20Hikvision camera:8080United States
  38. 92.118.39.75SSH:22Switzerlandinteractive
  39. 189.219.67.159Telnet:23Mexicointeractive
  40. 195.178.110.78Telnet:23 ×3 · 7sRomaniainteractive
  41. 172.236.254.181Hikvision camera:8080United States
  42. 93.174.95.106Modbus:502 ×2 · 1sNetherlands
  43. 5.187.38.30ESXi:8081Spain
  44. 172.169.250.32LDAP:389United States
  45. 211.185.81.244Telnet:23South Koreainteractive
  46. 195.182.16.23Hikvision camera:8080France
  47. 77.239.124.130SSH:22United Kingdominteractive
  48. 160.119.71.168Hikvision camera:8080South Africa
  49. 72.255.18.71Telnet:23 ×25 · 5mPakistaninteractive
  50. 79.44.76.209Telnet:23Italyinteractive
  51. 45.198.224.125ESXi:8081South Africa
  52. 91.92.40.12Hikvision camera:8080Bulgaria
  53. 77.239.124.64SSH:22 ×502 · 24hUnited Kingdominteractive
  54. 38.52.87.191Telnet:23 ×4 · 1m +1 moreUnited Statesinteractive
  55. 197.232.18.249SMB probe:445 ×3 · 3mKenya
  56. 64.62.197.62RDP probe:3389United States
  57. 41.38.203.7SMB probe:445 ×3 · 3mEgypt
  58. 103.140.19.91SMB probe:445 ×3 · 3mIndia
  59. 172.236.239.55Hikvision camera:8080United States
  60. 36.129.114.118SMB probe:445China · Liaoning

who --interactive last 24h

Hits on decoys that let an attacker log in and type commands.

  1. 42.113.165.199Telnet:23Vietnam
  2. 77.239.124.252Telnet:23 ×44 · 2mUnited Kingdom
  3. 128.199.97.232SSH:22 ×2 · 3mSingapore
  4. 92.118.39.50SSH:22Switzerland
  5. 45.79.181.104MySQL:3306 ×2 · 1sUnited States
  6. 195.178.110.78Telnet:23 ×14 · 32sRomania
  7. 13.72.73.58Telnet:23United States
  8. 147.185.132.150SSH:22United States
  9. 220.82.215.158Telnet:23South Korea
  10. 172.202.106.156MySQL:3306United States
  11. 122.155.132.40Telnet:23Thailand
  12. 92.118.39.75SSH:22 ×7 · 12mSwitzerland

events per hour

what they hit

  • SSH · interactive1,040
  • SMB probe568
  • Telnet · interactive298
  • NetBIOS probe31
  • Hikvision camera26
  • MSSQL probe24
  • RDP probe23
  • ESXi19

busiest sources

  1. 213.230.127.68Uzbekistan505
  2. 77.239.124.64United Kingdom502
  3. 77.239.124.45United Kingdom502
  4. 77.239.124.252United Kingdom220
  5. 45.33.76.69United States90
  6. 72.255.18.71Pakistan25
  7. 175.107.237.198Pakistan22
  8. 195.178.110.78Romania17
  9. 92.118.39.75Switzerland17
  10. 66.132.159.123United States8

where from

  • United Kingdom1,233
  • Uzbekistan505
  • United States161
  • Pakistan47
  • Romania20
  • Switzerland18
  • South Africa7
  • Argentina7

Repeated hits from one source within 10 minutes share one row (×hits · how long it went on).

cat README-before-you-use-this

  • Where the data comes from. One sensor, lab.txcyber.net, running honeypot software. It sees only what reaches that one machine, so this is a sample of background internet noise, not a picture of attacks on Texas or on anyone else.
  • Interactive decoys (violet) are full systems, not just login prompts: an attacker who connects can log in and type commands, and the sensor records what they do. A hit there is the closest thing on this page to a person at the keyboard. “Logged in” means the sensor saw a successful login. The commands themselves stay private, because they often carry live malware download links.
  • Sources are rarely the attacker's own computer. Most are hijacked servers and routers, rented cloud machines, proxies or research scanners. Don't treat an address here as proof of who is behind it.
  • Not a blocklist. Addresses change hands. If you want feeds for blocking, use a curated one.
  • Location is the sensor's IP lookup, shown at country level.
  • What we leave out: the usernames, passwords and payloads that attackers send are recorded by the sensor but never published here. Private addresses and the addresses we use for our own testing are filtered out.
  • Times are CST. The page checks for new events every 10 seconds while it is open.