Last update (UTC):
# connections: of which login attempts
# hosts: , # login sequences:
live data


Only last 200 hosts are displayed.

Legend: Connection established
Malicious host
Honeypot server Connected in the last 10 minutes Map controls:

Honeypot Statistics

Top usernames, passwords and countries. More statistics will be added in the future.

# Username Amount attempted
# Password Amount attempted
# Country Amount of attempts

Login sequence analysis

We detect possible botnets by applying a 'Density-based spatial clustering of applications with noise (DBSCAN)' machine learning algorithm to the recorded login sequences. Hosts listed here perform similar attacks.

Detailed information about connecting peers.

Last connection date (UTC) IP address Total connections Country Organisation Hostname

Live attempt data

Displays detailed information about recent login attempts.

Last connection date (UTC) IP address Country Organisation Hostname Username Password

Mesa SSH Honeypot

This website is still a work in progress.
We are mapping SSH login attempts and try to correlate them to find more insights in botnet activity.