TarPit-Lab — Open Threat Intelligence Honeypot

4,080,158 inbound probes captured

We run an intentionally exposed server that logs every inbound probe, scan, and exploit attempt it receives — 24 hours a day. What is this?

Live 385 probes/hour average
Latest threat pulse
Threat Pulse W39 — Volume Drop With Persistent RCE Campaign Pressure
Published Sep 21, 2026 · All reports →
9,240
Last 24 hours
63,992
Last 7 days
58
Countries — 24h
385
Probes / hour
⚡ 8 IPs flooding right now · 🔀 50 IPs probing multiple facades
🛡 CVE-2021-41773 CVE-2021-26855 CVE-2024-36401 CVE-2021-36260 CVE-2023-34362 CVE-2022-33982 CVE-2017-9841 CVE-2021-22005 CVE-2020-0618
Top Sources — most active sources, last 7 days
All threats →
# IP Country Organization Activity Flags Hits
1 103.46.186.85 🇮🇩 Indonesia (ID) PT Air Lintas Komunikasi scan 4,928
2 203.151.27.181 🇹🇭 Thailand (TH) Internet Thailand Company Limited scan 3,763
3 102.204.223.186 🇳🇬 Nigeria (NG) ABCCLOUD SDN.BHD. scan 2,471
4 87.120.104.29 🇳🇴 Norway (NO) Sino Worldwide Trading Limited recon 1,403
5 176.53.159.197 🇹🇷 Turkey (TR) ZORNTECH WEB SOLUTIONS scan 1,358
6 176.53.159.198 🇹🇷 Turkey (TR) ZORNTECH WEB SOLUTIONS scan 1,340
7 94.154.46.249 🇺🇸 United States (US) Omegatech LTD recon 1,200
8 142.93.218.50 🇮🇳 India (IN) DigitalOcean, LLC scan 1,170
9 186.244.245.82 🇺🇸 United States (US) AROSSCLOUD INC. scan 767
10 185.177.72.69 🇫🇷 France (FR) Bucklog SARL recon 718
Live feed
Full feed →
16:52:46 205.210.31.80 US scan
16:52:17 212.164.179.134 RU bruteforce pass=ms3456
16:52:14 212.164.179.134 RU scan
16:52:00 103.46.186.85 ID scan
16:49:57 103.46.186.85 ID scan
16:49:50 176.53.159.197 TR scan
16:49:50 176.53.159.197 TR scan
16:49:50 176.53.159.197 TR scan
16:49:50 176.53.159.197 TR scan
16:49:49 176.53.159.197 TR scan
16:49:49 176.53.159.197 TR scan
16:49:49 176.53.159.197 TR scan
16:49:49 176.53.159.197 TR scan
16:49:48 176.53.159.197 TR scan
16:49:48 176.53.159.197 TR scan
16:49:25 20.199.44.243 FR recon azure /
16:49:23 31.220.3.165 DE scan
16:48:37 31.220.3.165 DE scan UNSTABLE
16:48:26 31.220.3.165 DE scan
16:48:20 31.220.3.165 DE scan
16:48:09 31.220.3.165 DE scan
16:48:06 31.220.3.165 DE scan
16:48:03 31.220.3.165 DE scan
16:47:56 103.46.186.85 ID scan
16:47:51 31.220.3.165 DE bruteforce pass=1234
16:47:38 31.220.3.165 DE scan
16:46:32 185.12.59.118 NO recon /
16:45:55 103.46.186.85 ID scan
16:45:10 165.22.41.116 US scan
16:43:53 103.46.186.85 ID scan
16:41:52 103.46.186.85 ID scan
16:41:04 2.57.121.25 RO scan
16:40:09 66.240.236.116 US scan
16:39:53 103.46.186.85 ID scan
16:38:45 13.219.99.134 US recon aws /
16:38:33 8.217.107.107 HK scan
16:37:53 103.46.186.85 ID scan
16:37:22 198.235.24.121 US scan
16:35:50 103.46.186.85 ID scan
16:33:50 103.46.186.85 ID scan
16:33:30 31.129.246.172 UA rce ;sh echo
16:33:30 94.154.46.243 US recon /config/environment.rb
16:33:30 94.154.46.243 US recon /myapp/settings.py
16:33:30 94.154.46.243 US recon /web/.env
16:33:30 94.154.46.243 US recon /app/.env.local
16:33:30 94.154.46.243 US recon /.env.temp
Active campaigns — 24h
Intel →
AWS Credential File Harvesting LIVE
27 · 20m ago
Apache Path Traversal / RCE
2 · 7h ago
Docker REST API Exposure
3 · 1d ago
Exchange ProxyLogon
3 · 13h ago
GeoServer OGC Filter RCE
2 · 13h ago
OpenWrt LuCI Authentication Bypass RCE
1 · 23h ago
SSH Private Key & authorized_keys Web Exposure LIVE
36 · 20m ago
libredtail-http PHPUnit Botnet
2 · 7h ago
.env Editor Swap/Backup Variant Exposure LIVE
63 · 20m ago
.env File Harvesting LIVE
158 · 20m ago
.env Variant File Harvesting LIVE
74 · 20m ago
Apache .htpasswd / .htaccess Exposure Scan LIVE
24 · 20m ago
Apache Solr Admin API Exposure Scan
6 · 3h ago
BOA Web Server /boaform Admin Login Exploit
2 · 5h ago
Django settings.py Exposure Scan LIVE
13 · 20m ago
Extended .env Subdirectory Path Scan LIVE
124 · 20m ago
Fortinet/SSTP SSL-VPN Endpoint Probe
1 · 12h ago
Git Config Exposure in Subdirectory Paths
22 · 4h ago
HNAP Router RCE Scan
1 · 3h ago
Infrastructure Files Exposure LIVE
39 · 20m ago
Jenkins/Hudson Console Exposure Scan
1 · 7h ago
Joomla configuration.php Exposure LIVE
12 · 20m ago
PHP Config Backup File Exposure LIVE
24 · 20m ago
QNAP authLogin.cgi Probe
1 · 3h ago
Rails database.yml Configuration Exposure LIVE
12 · 20m ago
Spring Boot Actuator /env and /health Probe
4 · 15h ago
Spring Boot Actuator Exposure
3 · 1d ago
Symfony Debug Profiler Exposure Scan
1 · 4h ago
VMware vCenter developmentserver metadatauploader Probe
2 · 12h ago
WordPress wp-config Backup File Exposure LIVE
38 · 20m ago
secrets.json Sensitive File Exposure LIVE
12 · 20m ago
.env Testing/UAT/envrc Variant Scan
1 · 4h ago
AVTECH /evox/about Camera Scan
1 · 3h ago
Cisco ASA/AnyConnect +CSCOE+ Logon Page Scan
1 · 12h ago
Docker Compose File Exposure
1 · 4h ago
Generic /webui/ Management Interface Probe
2 · 13h ago
Git Config Exposure LIVE
41 · 20m ago
GitLab CI Configuration Exposure LIVE
13 · 20m ago
Node.js Package Manifest & Lockfile Exposure LIVE
24 · 20m ago
SharePoint /_layouts/ Endpoint Scan
2 · 13h ago
VMware/Camera /sdk SOAP Endpoint Probe
1 · 3h ago
config.js Client/Server Configuration Exposure LIVE
13 · 20m ago
config.json Sensitive File Exposure Scan LIVE
13 · 20m ago
HTTP/2 PRI Method Probe
4 · 3h ago
Microsoft FrontPage/_vti_pvt Probe
1 · 13h ago
PHP Info/Test Page Exposure Scan LIVE
38 · 20m ago