TarPit-Lab — Open Threat Intelligence Honeypot

4,125,644 inbound probes captured

We run an intentionally exposed server that logs every inbound probe, scan, and exploit attempt it receives — 24 hours a day. What is this?

Live 667 probes/hour average
Latest threat pulse
Threat Pulse W39 — Volume Drop With Persistent RCE Campaign Pressure
Published Sep 21, 2026 · All reports →
16,012
Last 24 hours
70,565
Last 7 days
64
Countries — 24h
667
Probes / hour
⚡ 12 IPs flooding right now · 🔀 50 IPs probing multiple facades
🛡 CVE-2021-41773 CVE-2021-26855 CVE-2024-36401 CVE-2021-36260 CVE-2023-34362 CVE-2022-33982 CVE-2024-4577 CVE-2017-9841 CVE-2021-22005 CVE-2020-0618
Top Sources — most active sources, last 7 days
All threats →
# IP Country Organization Activity Flags Hits
1 64.207.185.5 🇺🇸 United States (US) GoDaddy.com, LLC scan 7,593
2 50.62.135.24 🇺🇸 United States (US) GoDaddy.com, LLC scan 5,103
3 103.46.186.85 🇮🇩 Indonesia (ID) PT Air Lintas Komunikasi scan 4,975
4 31.220.3.165 🇩🇪 Germany (DE) Amarutu Technology Ltd scan 2,281
5 176.53.159.197 🇹🇷 Turkey (TR) ZORNTECH WEB SOLUTIONS scan 1,308
6 176.53.159.198 🇹🇷 Turkey (TR) ZORNTECH WEB SOLUTIONS scan 1,300
7 94.154.46.249 🇺🇸 United States (US) Omegatech LTD recon 1,200
8 121.184.203.46 🇰🇷 South Korea (KR) Korea Telecom rce 1,040
9 186.244.245.82 🇺🇸 United States (US) AROSSCLOUD INC. scan 769
10 85.11.167.7 🇳🇱 Netherlands (NL) TechTies Inc. scan 742
Live feed
Full feed →
14:56:23 64.207.185.5 US scan
14:56:23 223.123.73.38 PK bruteforce pass=epicrouter
14:56:22 64.207.185.5 US scan
14:56:22 64.207.185.5 US scan
14:56:21 223.123.73.38 PK scan
14:56:19 64.207.185.5 US scan
14:56:17 64.207.185.5 US scan
14:56:13 64.207.185.5 US bruteforce pass=vizxv
14:56:10 64.207.185.5 US scan
14:56:08 64.207.185.5 US bruteforce pass=
14:56:06 64.207.185.5 US scan
14:56:05 64.207.185.5 US scan
14:56:04 64.207.185.5 US scan
14:56:03 64.207.185.5 US scan
14:56:02 223.123.73.38 PK bruteforce pass=e8ehome
14:56:01 64.207.185.5 US scan
14:56:00 223.123.73.38 PK scan
14:56:00 64.207.185.5 US scan
14:55:58 64.207.185.5 US scan
14:55:57 64.207.185.5 US scan
14:55:56 64.207.185.5 US scan
14:55:55 64.207.185.5 US scan
14:55:54 64.207.185.5 US scan
14:55:53 64.207.185.5 US scan
14:55:51 64.207.185.5 US scan
14:55:51 64.207.185.5 US scan
14:55:51 64.207.185.5 US scan
14:55:48 64.207.185.5 US scan
14:55:48 64.207.185.5 US scan
14:55:46 31.220.3.165 DE scan
14:55:45 64.207.185.5 US scan
14:55:45 64.207.185.5 US scan
14:55:44 64.207.185.5 US bruteforce pass=888888
14:55:44 103.46.186.85 ID scan
14:55:43 64.207.185.5 US scan
14:55:42 64.207.185.5 US bruteforce pass=user
14:55:41 64.207.185.5 US scan
14:55:41 223.123.73.38 PK bruteforce pass=klv123
14:55:39 64.207.185.5 US scan
14:55:39 64.207.185.5 US scan
14:55:38 223.123.73.38 PK scan
14:55:38 64.207.185.5 US scan
14:55:35 64.207.185.5 US scan
14:55:34 64.207.185.5 US bruteforce pass=123456
14:55:33 64.207.185.5 US scan
14:55:32 64.207.185.5 US scan
14:55:31 64.207.185.5 US scan
14:55:30 64.207.185.5 US bruteforce pass=vizxv
14:55:30 185.242.226.102 US recon /
14:55:30 64.207.185.5 US scan
Active campaigns — 24h
Intel →
AWS Credential File Harvesting
10 · 9h ago
Apache Path Traversal / RCE
10 · 1h ago
Docker REST API Exposure
2 · 3h ago
Exchange ProxyLogon
6 · 1h ago
GeoServer OGC Filter RCE
2 · 11h ago
PHP allow_url_include RFI via Query String
8 · 1h ago
PHP pearcmd RFI via lang Parameter Path Traversal
4 · 3h ago
PHP-CGI Argument Injection RCE (CVE-2024-4577)
9 · 3h ago
PHPUnit eval-stdin RCE
3 · 4h ago
PHPUnit eval-stdin.php Extended Path Scan LIVE
55 · 59m ago
SSH Private Key & authorized_keys Web Exposure
12 · 9h ago
ThinkPHP invokefunction RCE
4 · 3h ago
libredtail-http PHPUnit Botnet LIVE
126 · 59m ago
.env Editor Swap/Backup Variant Exposure
20 · 9h ago
.env File Harvesting
64 · 3h ago
.env Variant File Harvesting
22 · 9h ago
Apache .htpasswd / .htaccess Exposure Scan
8 · 9h ago
Django settings.py Exposure Scan
4 · 9h ago
Extended .env Subdirectory Path Scan
40 · 9h ago
Git Credentials File Exposure
2 · 20h ago
HNAP Router RCE Scan
1 · 7h ago
Infrastructure Files Exposure
12 · 9h ago
Joomla configuration.php Exposure
4 · 9h ago
Kubernetes serviceaccount secret harvesting
2 · 20h ago
PHP Config Backup File Exposure
10 · 9h ago
PHP ini override RCE via query string
17 · 1h ago
PHP pearcmd RFI
2 · 3h ago
QNAP authLogin.cgi Probe
1 · 3h ago
Rails database.yml Configuration Exposure
4 · 9h ago
Spring Boot Actuator /env and /health Probe
4 · 20h ago
Spring Boot Actuator Exposure
2 · 20h ago
ThinkPHP invokefunction MD5 Probe
4 · 3h ago
VMware vCenter developmentserver metadatauploader Probe
2 · 5h ago
WordPress wp-config Backup File Exposure
12 · 9h ago
secrets.json Sensitive File Exposure
4 · 9h ago
AI/LLM API Endpoint Enumeration
1 · 2h ago
AVTECH /evox/about Camera Scan
1 · 7h ago
Cisco ASA/AnyConnect +CSCOE+ Logon Page Scan
1 · 3h ago
Generic /webui/ Management Interface Probe
3 · 11h ago
Git Config Exposure LIVE
21 · 45m ago
GitLab CI Configuration Exposure
4 · 9h ago
Node.js Package Manifest & Lockfile Exposure
12 · 9h ago
SharePoint /_layouts/ Endpoint Scan
2 · 11h ago
VMware/Camera /sdk SOAP Endpoint Probe
1 · 7h ago
config.js Client/Server Configuration Exposure
6 · 9h ago
config.json Sensitive File Exposure Scan
8 · 4h ago
phpMyAdmin Admin Panel Scan
6 · 20h ago
HTTP/2 PRI Method Probe
5 · 8h ago
Microsoft FrontPage/_vti_pvt Probe
1 · 11h ago
PHP Info/Test Page Exposure Scan
14 · 9h ago