Live data · two honeypots
Security
Two honeypots feed this page. This site logs scans on paths like
/wp-admin and /.env that don't exist
here. Never did, this is static HTML. AMvpn
runs a real SSH honeypot that's been catching attack traffic since
April. Everything below is aggregate: no individual IPs, ever.
This site
Loading…
Daily activity
This site, last 30 days.
What's getting probed
This site, most-hit paths, all time.
AMvpn's SSH honeypot
Loading…
Where it's coming from
AMvpn, top attacking countries, all time.
How it works
This site: a handful of paths that only ever get hit by automated scanners (common WordPress, PHP, and admin-panel probes) are logged like any other request, but return the exact same 404 status a real typo would. The only difference: they get a slightly different page. A script tallies hits every 15 minutes, and a weekly summary goes to me directly.
AMvpn: a real Cowrie SSH/Telnet honeypot on a separate VM, enriched with GeoIP data, feeding a live dashboard and Telegram alerts. Once an hour, an aggregate summary (never raw IPs or session data) gets pushed here over a restricted SSH connection that can only overwrite that one file. Full write-up on the case study page.
No third-party tracking
No third-party analytics, ad trackers, or marketing pixels run on this site, and never have. Fonts are self-hosted for the same reason: loading a page here doesn't quietly ping Google Fonts (or anyone else) with your IP just because you showed up. Nothing on this site makes a request to a third-party domain.
The honeypot above isn't tracking either: it only logs
requests to bait paths, like /wp-admin and
/.env, that no real visitor would ever hit
browsing the actual site. Real visits still land in a standard
server access log, IPs included, the same as any web server
keeps. That log stays local, isn't shared or sold, and isn't
used to profile anyone.