Security research, threat intelligence insights, and product updates.
We observed a Redis exploitation bot in its natural habitat: an unprotected instance on port 6379. What followed was a textbook cron injection, captured in full by our honeypot network. INFO recon, 6.5 seconds of stillness, then 25 commands in 11 seconds. A parasitoid wasp in digital form.
Our honeypot sensors emulate exposed Docker daemons and record everything attackers do. We pulled a 24-hour snapshot: 3,964 events from 144 IPs, container escapes via nsenter, SSH key backdoors locked with chattr, a self-replicating worm from 100 IPs, and cron persistence — all before anyone touched the application layer.
Browse 33,000+ usernames from real brute-force attacks across SSH, FTP, Telnet, and 11 more protocols. Free to search, updated daily from live honeypot data.
A new bot is actively identifying Cowrie, Kippo, Dionaea, Glastopf, OpenCanary, and Honeytrap installations before deciding whether to attack. We captured the full session. Nobody else is talking about this.