Observed arrival · 2026-10-31
Honeyjar’s live honeynet map
A dashboard for attacks hitting internet-facing honeypot sensors, grouped by activity, vulnerabilities, origins, and MITRE ATT&CK.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Security researchers and defenders tracking honeypot activity
- Worth noticing
- The page says attacker-supplied URLs and IPs in payloads are defanged, and cites DB-IP, CISA KEV, and FIRST.
Field notes
The dashboard separates attack events, login attempts, exploit attempts, source countries, and protocol activity, with time filters ranging from one hour to all available data. Its page describes vulnerability context using CISA KEV and EPSS, and links to sections for credentials, ATT&CK classifications, and payloads. In this snapshot, the feed is still connecting and several panels report no data.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
⊠LoginAccess appeared gated
✦PrettyNotable craft visible
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue