LLM·PAUSED historical snapshot · last reviewed 2026-06-12 · verification required
DECEPTION GRID HNY · public-sensor

Honeypots.

Tripwires that look like soft targets. A dedicated decoy has no intended production traffic, so unexpected connections are high-signal leads — not proof of malicious intent. Below is the latest verified snapshot from a hardened public sensor, plus lab profiles modeled on enterprise, hospital, and laboratory attack surfaces.

See the decoy profiles ↓ Commission a custom honeypot →
SENSOR ACTIVITY OFFLINE

sensor activity

Telemetry is offline until a fresh, sanitized feed passes verification. No source addresses are embedded in this page.

0events / 30d
0unique sources
0decoy services
0peak day
daily connection attempts →

by decoy service

masked source networks

Masked network summaries appear only after the browser verifies a fresh feed.

Last verified not available · checked every 60s · passive sensor · connection metadata only.

DECOY PROFILES11 PROFILES

honeypots tuned to real breaches

Each profile imitates the surface of a named CVE so the right attackers engage it. live armed planned

enterprise — blackhat favorites

CVE-2021-44228 live

Log4Shell

Apache Log4j

Any Java web app was a target. We log the ${jndi:ldap://…} probes that never stopped coming.

HTTP headers — JNDI lookup
⬡ internet-wide JNDI exploitation, Dec 2021 — still scanned daily
CVE-2025-61882 armed

Oracle E-Business Suite

Oracle

Unauthenticated RCE in the EBS Concurrent Processing tier. We present the /OA_HTML login attackers fingerprint before firing.

HTTP — /OA_HTML BES servlet
⬡ Cl0p mass-exploitation of Oracle EBS, 2025
CVE-2023-34362 armed

MOVEit Transfer

Progress

A SQLi-to-RCE in the transfer portal that fed one of the largest extortion campaigns on record.

HTTPS — managed file transfer portal
⬡ Cl0p mass data theft from 2,700+ orgs, 2023
CVE-2021-34473 armed

Exchange ProxyShell

Microsoft

Auth bypass to RCE on Outlook Web Access — webshells dropped on tens of thousands of servers.

HTTPS — /autodiscover OWA
⬡ mass on-prem Exchange compromise, 2021
CVE-2023-4966 planned

Citrix Bleed (NetScaler)

Citrix

Leaked session tokens straight out of memory — bypassed MFA at hospitals and agencies alike.

HTTPS — NetScaler Gateway
⬡ session-token theft hitting healthcare + govt, 2023
CVE-2024-21762 planned

FortiOS SSL-VPN

Fortinet

The perimeter device that was supposed to keep them out became the way in.

HTTPS — SSL-VPN portal
⬡ pre-auth RCE on edge firewalls, ransomware entry point

healthcare & hospital

unauthenticated DICOM C-STORE live

DICOM / PACS Imaging

Medical Imaging

Medical imaging servers sit on the internet with no auth. We answer the DICOM association requests scanners send and log every one.

TCP 11112 — DICOM upper layer
⬡ thousands of exposed PACS leaking patient scans, ongoing
CVE-2024-1709 armed

Healthcare Claims Portal

ScreenConnect-class

An auth-bypass on a remote-access tool took down claims processing for a third of US healthcare. We bait the same surface.

HTTPS — remote-access auth bypass
⬡ Change Healthcare / ALPHV, 2024 — US claims processing halted
CVE-2023-43426 armed

OpenEMR

OpenEMR

The EHR running in clinics worldwide. Auth bypass plus file write equals patient-record access.

HTTP — /interface login
⬡ RCE chain in the most-deployed open-source EHR

laboratory science

unauthenticated MLLP live

HL7 v2 Interface

Health Data Exchange

Lab results and orders flow between systems over HL7 with no authentication. We accept the MLLP frames and log the senders.

TCP 2575 — MLLP
⬡ lab + EHR feeds exchanged in cleartext, no auth
exposed LIMS web console planned

Lab Information System (LIMS)

Laboratory Science

The systems that hold sample chains, assay results, and research data — often one default credential from exposure.

HTTP — LIMS console
⬡ research + clinical lab data, weak-auth web consoles
See honeypot pricing →
CUSTOM BUILDSSCOPED

what a custom honeypot gets you

  • decoys that look like you. services that imitate your real hostnames, banners, and login portals — or the exact CVE surface you're worried about.
  • high-signal, not magic. every alert is investigated as a lead; scanners, health checks, and misroutes can still be benign.
  • your alerting. hits pipe to your slack / teams / siem in the format your soc already reads.
  • sector-aware. hospital, lab, OT, or enterprise — the lure is tuned to what your attackers actually hunt.
  • legal & passive. public blue-team deception on infrastructure you own. it records, it never attacks back.
See honeypot pricing →