Skip to main content
honeypot.observer
AboutMethodologyFeedDispatchBlog
Live
snapshot
Recent activity · the feed

Mostly noise.
We surface the signal.

Most of what reaches a honeypot is automated scanning and brute force. The sessions worth watching touch our AI and MCP decoys, and those are the ones we surface and explain. Last 24 hours: 1,376 sessions across 3 sensors.

Snapshot · data as of Jul 4, 2026, 14:38 UTC

lit = the AI / MCP signal
the dim field is the noise
events / hour (24h)
200 total
24h ago
SSHHTTPAIOther
now
70 lone probes hidden · connect attempts and byte garbage with no pattern
honeypot.observer
AboutMethodologyFeedBlog
© 2026 honeypot.observer·Passive observation only
Watching since 2025