What is hitting the decoys right now

Every figure here is a measurement from this fleet, refreshed as the collector rebuilds. Classification only — never the payload.

time to discovery · fixed

exposure → first probe

first probe since launch · fixed

traffic · last hour, per minute

{{ hero.perMin }}/min~{{ hero.perHr }} / hr

series.json did not load — no rate shown rather than a stale one.

live intercepts

◆ Model demand · live · {{ demand.seen }} models seen

Ranked by distinct sources asking, so one noisy scanner can't own the board. The faint bar behind is total probes — where it runs long, few sources are asking loudly.

{{ r.sources }} · {{ r.probes }}

distinct sources probes{{ demand.tailNote }}

◆ Attack surface

Which kind of endpoint they target. Raw model APIs dominate; the MCP sliver is rarer but sharper.

{{ surface.llmPct }} model APIs{{ surface.mcpPct }} MCP

LLMjacking

{{ surface.llmPct }} · stealing compute

MCP-jacking

{{ surface.mcpPct }} · tool-server abuse

one cell = 1% of probes · {{ surface.mcpRce }}% of MCP probes attempted code execution, against {{ surface.llmRce }}% of the rest — attempts, not outcomes

◆ What they're doing

Intent of every captured probe, mutually exclusive.

{{ it.pctS }} · {{ it.count }}

0{{ intentAxisMid }}{{ intentAxisMax }}% of probes

◆ What the record shows · {{ rec.span }}

of sources came back on a later day

attempts to execute code

new sources / day

series.json did not load, so the daily curve and its trend are not shown.

{{ rec.dayFirst }}dashed = window average {{ rec.avg }}{{ rec.dayLast }}

◆ Escalation funnel

scan → fingerprint → cred → abuse → exfil → RCE. Columns show how many probes reached each stage or deeper; the dimmed number is how many stopped there. Most traffic is noise; the drop-off is the story. Square-root scale so the deep end stays legible.

◆ Probe signals · {{ schemaVer }}

named tradecraft tells · bars scaled to the most frequent

◆ How they run · UTC

{{ clocks.denom }} sources with 20+ probes

Individual sources keep a clock. In aggregate those clocks cancel out. Each row is one kind of clock and how many sources keep it.

{{ c.count }} · {{ c.pct }}

◆ Live feed · {{ feed.note }}

agooriginsurfaceverdictmodel / tellsev

↳ {{ r.model }}{{ r.tell }}

showing {{ feed.shown }} of {{ feed.total }} {{ feed.window }} · classification only, never raw payloadsall strings attacker-controlled · rendered inert

Every board, one page

Each board ranks by distinct sources rather than raw volume where the data allows it, so one loud source cannot own a board.

◆ Technique mix over time · hourly, UTC

four lanes, one clock · each lane scaled to its own peak

Hourly series unavailable

series.json did not load. No lanes are drawn rather than a generated shape — an invented curve here would read as a measurement.

{{ ln.peak }}/h

{{ axis.first }}{{ axis.mid }}{{ axis.last }} · now

◆ Verdicts · classification

log scale{{ verdictSpan }}

a linear bar would make everything under 10,000 invisible — here each grid line is ×10

◆ Surfaces · which decoy

area = probes · {{ surfaceTotal }} across {{ surfaceCount }} decoys

four decoys — {{ surfaceTop4Names }} — take {{ surfaceTop4 }} of all probes; the rest is a long tail of niche servers

◆ Probe fingerprints · canned prompts

{{ fpTotal }} probes matched a known canned prompt

two greetings account for {{ fpTop2 }} — most bots only check the model answers, not what it says

◆ Top networks · ASN

cumulative share of all probes

100%50%0

the top three networks carry {{ networkTop3 }} of everything; twelve carry {{ networkTop12 }}

◆ Key formats presented · distinct sources

one square = {{ keyUnit }} · {{ keyTotal }} total

"no known format" is a random string in the Authorization header — a guess, not a leaked key

◆ Anonymized sources · one dot, one origin

probes per source, log scale · {{ swarmCount }} sources in window{{ swarmSizeNote }}

◆ Hour of day · every probe · UTC · {{ dial.denom }}

busiest hour{{ dial.peakLabel }} · {{ dial.peakCount }} quietest hour{{ dial.lowLabel }} · {{ dial.lowCount }} office hours share{{ dial.officeShare }}

PEAK

Sources that came back

Traffic grouped by client fingerprint. A group means the same client returned — not who is behind it. Networks named are where traffic arrived from: often a relay, a rented host, or a compromised machine.

◆ Seen by other sensors

Corroboration unavailable

{{ corr.downWhy }} No figure is shown here rather than a stale one — “we could not check” is not the same as “nothing was found”.

Every other figure here is what this fleet saw. These come from an independent public feed of addresses reported by other operators' sensors — cross-referenced locally, so nothing about any source is sent anywhere.

{{ corr.seenPct }}of {{ corr.total }} sources were reported by someone else the same day

{{ corr.seen }} also seen elsewhere{{ corr.unseen }} only here

probes per source

reported elsewhere · {{ corr.inAvg }}

seen only here · {{ corr.outAvg }}

The sources no other sensor reported are the ones that probe hardest here.

known internet scanners

{{ corr.scanPct }}of sources · {{ corr.scanEvPct }} of probes

{{ corr.scanSrc }} sources across {{ corr.scanASNs }} networks that publish their scanning. Counted, not removed — subtract them if you want a figure without.

Reported-address data: {{ corr.attribution }}

◆ Top 10 repeat offenders · ranked by events · rhythm in UTC

when they come back · all times UTC

One line per source: the hour-of-day rhythm of its returns, the weekdays it favours, and its busiest hour.

fingerprint grouphour of return
00 → 23 · amber = peakweekday
mo → subusiest hour

{{ t.rank }} {{ t.origin }} {{ t.cc }}evidence {{ t.evidence }} · {{ t.events }} events · {{ t.rhythmLabel }}

{{ t.gapPrefix }}{{ t.gap }}

◆ Repeat sources · grouped by client fingerprint

— no group met the publishing bar in this window —

Traffic that came back. Events are grouped where they share a client fingerprint — this says the same client returned, not who is behind it. Networks named are where traffic arrived from, often a relay, a rented host or a compromised machine.

{{ meta.groups }} of {{ meta.allGroups }} groups meet the publishing bar · {{ meta.events }} events · {{ meta.window }}

Grouping unavailable

The campaigns snapshot did not load, so no group is shown. An empty table here means the channel is down, not that nothing came back.

origin networkdaily activity · {{ meta.windowShort }}
shared log · 1 → {{ meta.maxDay }}/day · rule 30events
bar to {{ meta.maxEvents }}evidence ▼

What is collected, and what is never published

Every figure on this site is a measurement from one research fleet. Classification only — never the payload, never an address.

disclaimer

Scope & data handling

honeyprompt is an independent AI-security research project. It operates a fleet of decoy AI endpoints and records how automated systems attempt to abuse exposed AI infrastructure. Everything published here is aggregate classification of that observed traffic.

the wall · addresses never cross it

private · access-controlled · encrypted backups

public · aggregate · rendered inert

what happens to each field of a request

publishedtransformed, then publishednever published

inboundbecomesstate

→{{ f.becomes }}

what we publish

·Categories, counts and verdicts

·A fixed vocabulary of tradecraft tags

·Network (ASN + organisation) and country

·An anonymized source id — stable, but never reversible to an address

what we never publish

·Raw prompt text or payloads

·Source IP addresses

·Any per-host identifier

·Anything that maps a published id back to an address

legal basis

Processing rests on legitimate interest (Art. 6(1)(f) GDPR) in securing infrastructure and conducting security research. Source addresses reach this site only as unsolicited inbound connections.

how addresses are held

Privately, on access-controlled infrastructure, with encrypted backups. They are never published, never used to identify individuals, and never shared or sold.

retention & erasure

Research records are kept for as long as the research runs. Erasure of an address may be requested at any time, via the route under Contact.

untrusted data

Every string shown is attacker-controlled. All of it is rendered inert as plain text.

accuracy

Classification is automated and may contain errors. Figures describe observed probe traffic, not confirmed compromise — and are not an accusation against any named organisation.

contact

Network operators may request context or correction; data subjects may request erasure. This project is run independently — requests may be directed to abuse at this domain.

Provided “as is” for research and informational purposes · not legal advice · not affiliated with any cloud or model provider named in the data.