A honeypot research project
What the internet tries, measured.
Decoyra runs decoy servers on several continents. Nothing legitimate ever talks to them, so everything they record is an attack. We turn that into open threat intelligence.
Illustration. The figures below are measured.
Loading the latest figures…
This week on the decoys
Taken from the open feed. Every figure is counted from recorded traffic; nothing here is an estimate.
Vulnerabilities being exploited, last 7 days
“Reached us after” is the time between the official publication of a vulnerability and the first attempt the decoys recorded. Dates and scores: CVE Program. Exploited status: CISA.
What attackers attempt, in MITRE ATT&CK terms
Recorded events in 7 days. The bars use a square-root scale: scanning outnumbers everything else a hundred to one. Nothing succeeded; decoys never run what they receive.
After a successful login: the most common script
The SSH decoy accepts weak passwords and answers like a shell, but it is an emulation: nothing is executed, downloads fail, uploads are only hashed.
How the measurements are made
Decoys look like services attackers hunt for. A central collects what reaches them, groups it and names it. Only confirmed findings are published.
- Decoys: Websites and admin panels, SSH with an emulated shell, Databases and caches, Remote desktop and file shares, VPN gateways and appliances, AI model servers.
- Central: groups requests into patterns; names known exploits (CVE); maps to MITRE ATT&CK; links addresses to campaigns; lists only what two decoys saw.
- Published: Block lists for firewalls, STIX, MISP and TAXII feeds, Suricata detection rules, Weekly situation report.
- Decoys never execute anything. What attackers send is recorded, not run, fetched or forwarded.
- Two decoys must agree. An address is listed only after at least two decoys confirmed it; research scanners are not listed for scanning.
- Third parties do not count. Requests a web page can make a visitor's browser send are recorded but never held against that visitor.
- Passwords stay private. Credentials typed into decoys are never published or handed to anyone.
What we are looking into
The fleet is an instrument. These are the questions it is pointed at.
How fast is a new flaw exploited?
For every vulnerability with a signature we record the first attempt and compare it with the publication date. Some arrive years late, some within days.
What happens after the door opens?
Thousands of sessions follow a handful of scripts: look around, fetch a tool, start a miner, add a key, clean up. We group them into playbooks and watch them change.
Are AI agents part of the traffic?
Decoy pages carry instructions that people never see and only an AI agent would follow. A visitor that follows them tells us what it is.
Who works together?
Addresses that use the same set of techniques are one tool or botnet. Grouping them shows campaigns instead of single addresses.
Three ways to use it
Decoyra is a research project, not a shop. The open feed is free. For the rest, write and tell us what you are working on.
For everyone
Open feed
Block lists, indicators, detection rules and a weekly report, on GitHub.
- Free, licensed CC BY 4.0
- Formats for firewalls, MISP, STIX and Suricata
- Planned to run one day behind the fleet
For researchers and security teams
Research access
The same data as it happens, with the context the open feed leaves out.
- Current data over an API and TAXII 2.1
- Patterns, campaigns and playbooks in detail
- An MCP endpoint for AI assistants, read-only
For organisations
Your own decoys
Decoys in your network or cloud. Nothing legitimate touches them, so every contact is worth an alert.
- Sensors small enough for the cheapest server
- Your data stays separate from the public fleet
- Run as a pilot, set up together with you
Research access and pilots are arranged individually. There is no automatic sign-up and no price list.