honeypot.fyi

Yes, this website is a honeypot.

Recent Updates

  • 4/3/2024 - Having logged over 5,024,623 potential attacks from 788,963 IPs (~0.021% of all IPv4s!), we have decided to improve our organization a bit. Logs from past years are now offered in compressed (zipped) files. Similarly, we have decided to refresh our block lists file. The original one (containing data from the start of our logs through today) can still be found below. New attacks will only be recorded in the refereshed file (which will also include all attacks seen thusfar in 2024). All data is still accessible on our intel page.
  • 8/28/2022 - Honeypot.FYI has logged over 1,637,367 potential attacks from 307,245 IP addresses (about 0.007% of all IPv4s)!
  • 5/21/2022 - Honeypot.FYI has logged over 1,148,389 potential attacks from 208,339 IP addresses (which is about 0.005% of all IPv4 addresses)!
  • 3/7/2022 - Honeypot.FYI has logged over 792,743 potential attacks from 148,376 IP addresses (which is about 0.003% of all IPv4 addresses)!
  • 12/13/2021 - Added new detection type for log4j ldap vulnerability

Background

This website is a honeypot that posts its data publicly every day. This data is avaliable in three ways:

  • The blocklist is a CSV containing a deduplicated list of IP addresses that have attacked honeypot.fyi.
  • The logs show the daily attacks against honeypot.fyi.
  • The intelligence data allows you to search for an IP address and see all of its honeypot.fyi detections.

Logs