Live demo
AI agents
1,385AI-agent sessions · 30d
What autonomous AI agents do once they find something that looks like an AI tool server or model API.
live from the sensorsBlue team · defend
Who is attacking the internet right now.
blackpot.io runs decoy servers on the open internet. Nobody legitimate has a reason to connect, so every number below is a real attack: where it came from, what it hit, and a free blocklist of the addresses behind it.
snapshot 4 min ago · 15-minute delay · since 2026-08-29: 59,380 sessions from 12,536 IPs
Attack sessions · 24h
13,740
2,649 source IPs
Countries · 24h
100
most from NL
Login attempts · 24h
117,696
passwords sprayed at the decoys
Most attacked · 24h
2,087
sessions on RDP
Attackers reported · 30d
637
to AbuseIPDB · free blocklist below
Attack origins · 24h
Blue team · defend🇳🇱 Netherlands 3,977🇺🇸 United States 3,056🇭🇰 Hong Kong 1,299🇩🇪 Germany 1,006🇬🇧 United Kingdom 699🇮🇳 India 444🇰🇷 South Korea 361🇻🇳 Vietnam 275🇧🇷 Brazil 197🇦🇹 Austria 183
Event feed
- 07:24Z🇧🇩103.159.2.xSSHpassword guessing
- 07:24Z🇳🇱144.225.43.xRDPpassword guessing
- 07:24Z🇬🇧167.99.207.xSSHconnection probe
- 07:24Z🇬🇧94.26.88.xRDPpassword guessing
- 07:23Z🇺🇸64.181.193.xHTTPweb scanning
- 07:23Z🇮🇳45.112.149.xHTTPweb scanning
- 07:23Z🇩🇪194.180.48.xHTTPSweb scanning
- 07:23Z🇮🇷37.148.36.xSSHran commands
- 07:23Z🇺🇸163.192.218.xHTTPweb scanning
- 07:23Z🇺🇸147.224.149.xHTTPweb scanning
- 07:23Z🇺🇸147.224.199.xHTTPweb scanning
- 07:22Z🇰🇷43.155.252.xRDPpassword guessing
Tempo · sessions per hour
Blue team · defendServices attacked · 24h
Blue team · defend- RDP2,087
- HTTP1,766
- Kubernetes API1,685
- MS SQL1,637
- Docker API1,359
- HTTPS1,289
- Elasticsearch1,166
- SSH955
- Redis401
- VNC400
Sensor detail
Attackers read this page too. The detail behind these numbers shows how our decoys work, so it stays out of public view. The counts are real and come from the same snapshot as everything above. Sensor detail is available in a live demo.
Live demo
Stolen-key trails
2,514sessions reusing a planted credential · 30d
Where credentials taken from a decoy are used next, and how far the trail goes.
Live demo
Malware
57samples caught · 30d
Files attackers dropped or fetched, with family, configuration and infrastructure pulled out by static analysis.
Live demo
Attacker playbooks
22ATT&CK techniques seen · 7d
Hands-on-keyboard sessions mapped to MITRE ATT&CK, step by step.
Live demo
Exploit radar
9sessions with a known exploit · 24h
Which known vulnerabilities are being fired at internet-facing services right now.
Live demo
Operator clusters
54clusters active · 30d
Many addresses, one operator: sessions grouped by how they behave, not where they come from.
Live demo
AI-agent behaviour research
1,171sessions in the study · 30d
Ongoing experiments on how AI agents react to what they read on a target.
Block them · free threat feed
Blue team · defendnft add table inet blackpot
nft add set inet blackpot bad '{ type ipv4_addr; }'
nft add chain inet blackpot input '{ type filter hook input priority -10; policy accept; }'
nft add rule inet blackpot input ip saddr @bad drop
nft add element inet blackpot bad "{ $(curl -s https://blackpot.io/threat-feed/ips.txt | grep -Ev '^#|:' | paste -sd, -) }"- /threat-feed/ips.txtIPs we reported to AbuseIPDB
- /threat-feed/hashes.txtmalware SHA-256
- /threat-feed/urls.txtverified malware URLs (live)
- /threat-feed/feed.jsonall of it, with dates
- How the feed is built →
How we count
Blue + purple- Window
- Everything is keyed on when a session started. "24h" ends at the snapshot cutoff, which is 15 minutes behind real time. A few long sessions are written to the database late, so the newest hour can grow slightly in the next snapshot.
- Session
- One connection to a decoy. A bot that reconnects 500 times is 500 sessions; that is why the IP counts sit beside them. Our own test traffic is excluded.
- Countries
- From the source IP’s geolocation. Sessions with no geo match are kept but not counted as a country.
- Login attempts
- Every username and password sent to any decoy in the window.
- Event feed
- The newest sessions, at most three per /24 so one noisy scanner cannot fill it, each with one plain label for what it tried: a connection probe, web scanning, password guessing, an exploit attempt, running commands, or dropping a file.
- Attackers reported
- Addresses we reported to AbuseIPDB in the last 30 days: the same list as /threat-feed/ips.txt.
- Locked sections
- Real counts from the same snapshot. The detail behind them would show attackers how our decoys work, so it is shown in a live demo instead of here. The blurred pictures are decoration and contain no data.
- Privacy
- Attacker IPs are cut to /24 (a.b.c.x). Nothing an attacker typed or sent is published on this page, and sensor locations are not disclosed.