ATTACKS TODAY
—
UTC day · Cowrie eventsTODAY
INTERNET THREAT MONITOR
See the internet
knocking.
A live view of unsolicited traffic and login guesses observed on the GCI sensor.
What am I looking at?
This observatory runs Cowrie, an SSH honeypot, on a public Google Cloud VM. It imitates a vulnerable server to record automated login attempts, password guesses, and commands bots use to retrieve malware.
CT
OBSERVEUNDERSTANDWaiting for live metrics. The same-origin metrics feed includes daily aggregates and redacted session summaries, refreshed every five minutes.
NO SAMPLE DATAUNIQUE SOURCES
—
Distinct source addressesTODAY
Repeat source profiles appear in Threat Intel.
TOP SOURCE COUNTRY
—
Awaiting feedTODAY
TOP PASSWORD
—
Aggregate onlyTODAY
Share of all login attempts
TOP USERNAME
—
Aggregate onlyTODAY
Share of all login attempts
LATEST SENSOR EVENTS
Live attacks
- Waiting for recent login activity
Recent Cowrie login events · UTC · source addresses and submitted credentials are withheld
HISTORICAL ACTIVITY
Attack timeline
—attacks · last 7 days DAILY ATTACK EVENTS
—UTC—
AUTOMATED HIGHLIGHT
Featured attack of the day
The most interesting session is selected from today’s observed activity.
Credentials, source addresses, and raw commands are withheld.
Browse attack sessions →INTERACTIVE ATTACK ARCHIVE
Attack sessions
Explore a selection of today’s most interesting Cowrie sessions. Select a story to inspect its summary and redacted event timeline. Scores and categories are exploration heuristics, not confirmed threat-actor or malware-family attributions.
Successful loginPassword guessingPrivilege escalationFile downloadDownload attemptReconnaissance
FEATURED ATTACK OF THE DAY
Waiting for a session
UTC TODAY
Redacted session summary will appear here.
DURATION—
COMMANDS—
LOGIN—
DOWNLOADS—
RISK SCORE—
SESSION RECONSTRUCTION
Attack timeline
Credentials, source addresses, URLs, and full shell commands are withheld.
- Waiting for an eligible session
GEOGRAPHIC DISTRIBUTION
Top countries
- Waiting for live metrics
AUTHENTICATION ACTIVITY
Top usernames
- Waiting for live metrics
AUTHENTICATION ACTIVITY
Top passwords
- Waiting for live metrics
EXPOSED SERVICES
Top destination ports
- Waiting for live metrics
COMMAND ACTIVITY
Download tooling observed
Cowrie command entries that invoke wget, curl, or busybox. Full commands remain in the private event store.
- Waiting for live metrics
OBSERVED SOURCE PROFILES
Top repeat offenders
Sources seen repeatedly by this Cowrie sensor, ranked by failed and successful login attempts. IP and network ownership data are observational signals and do not identify a person or prove who operated a host.
- Loading repeat offender profiles
IP addresses are shown as observed by the honeypot. ASN and cloud-provider labels use best-effort enrichment; network ownership can change.
THE PROJECT
Turning background noise
into understanding.
Internet-facing services receive automated scans and login attempts. Cowrie records activity in an isolated honeypot; a local worker enriches and aggregates the events before this page receives summary metrics.
The Threat Intel page lists up to 20 globally routable source addresses seen in repeated login attempts, with country and ASN/hosting enrichment. An IP identifies a network endpoint, not a person, and network attribution may be inaccurate. Credentials, full commands, and download URLs remain private; password rankings are aggregates of values submitted to the honeypot.
01⌁CollectCowrie honeypot
→02▤EnrichLocal GeoIP data
→03◷AnalyzePrivate SQLite store
→04◫ObserveAggregates & profiles