Flytrap: Live Cyber Attack Map

Overview

Top Sources (last 24 hours)

Map

Search

Search by IP (1.2.3.4), CIDR (1.2.3.0/24), ASN (AS64512, 64512, or 3.2213), or country code (US, CA, BE).

Last 5 Minutes

Source IP, ASN, country, and destination port only. Our own infrastructure is never shown. Not auto-updating. Use Refresh.

What this data actually shows

We run a public IP with nothing on it. No website, no mail server, no anything a real visitor would ever want. Anything that connects to it wasn't invited, which makes it a clean way to watch what the internet actually does when nobody's looking.

Right now we're seeing a steady mix of TCP scanning and a smaller, quieter stream of UDP probes. TCP dominates because it's cheap and unambiguous for an attacker to run at scale, a single SYN packet tells you in one round trip whether something's listening. SSH, RDP and Telnet show up constantly, along with SMB, all the classic access points botnets and credential-stuffing tools go after first. We've also watched the same source IP retry an SMTP connection six times in five seconds, which is what an automated relay-hunting script looks like when it doesn't get an answer. The ports named here are the ones worth checking on your own server before a scan finds them for you, and a server check covers the same surface from the outside.

UDP tells a different story. SIP shows up a lot, VoIP infrastructure gets probed heavily and consistently. SNMP and NTP appear too, often from sources checking whether they've found an open amplification target rather than anything aimed at us specifically. SSDP and mDNS point at IoT and device discovery scans. We've seen BACnet, which is a building automation protocol, meaning someone out there is specifically hunting for exposed industrial and facilities control systems. Port 1434 still gets hit occasionally, decades after the Slammer worm made it infamous.

IPv6 barely registers by comparison. Out of everything we log, IPv6 traffic is a tiny fraction of the total, and that gap is really the whole story of why IPv4 gets hammered and IPv6 doesn't. IPv4's address space is small enough that scanning all of it is a weekend project for anyone with a botnet. IPv6 per subnet alone has more addresses than anyone could ever brute-force, so attackers rely on DNS records, certificate transparency logs and leaked lists instead of blind scanning. A telescope with nothing pointing at it from either protocol makes that difference obvious in a way a live production server never would. If you are wondering which of the two your own site answers on, the IPv6 test tells you in a few seconds, and reaching an IPv4-only audience is worth knowing about before it shows up as a support ticket.

None of this is unique to us. Every unused IP on the internet sees roughly this shape of traffic, which is the actual point, this is what the background noise looks like everywhere, all the time, whether anyone's watching or not. The same is true of performance, which is why the aggregate analytics are worth a look alongside this, what a typical site scores says more about the web than any single report does.

How we get this data

Every connection attempt that reaches this IP gets logged before it's dropped. We whitelist our own management access and infrastructure so we're not counting ourselves, everything else that shows up is unsolicited by definition. Each source IP gets enriched against MaxMind's databases for network ownership, ASN and rough geography, and destination ports get matched against IANA's official service name registry so a hit on port 1433 shows up as MS-SQL rather than a bare number.

We also maintain a manual allowlist for networks we've confirmed belong to legitimate internet research, companies like Censys and Onyphe run continuous scanning as their actual business, cataloguing what's reachable rather than trying to break into it. We exclude those from anything we flag as suspicious, since lumping a research crawler in with a credential-stuffing botnet would make the data less useful, not more. This is the same anonymized, aggregated approach behind our Global Analytics data, just pointed at unsolicited traffic instead of site performance.

Questions, feedback, or a benign network request

Write to [email protected] if you want to know whether a network hitting this sensor is yours, or if you need anything else about the data on this page.