BoarNet is on hiatus.
Operating costs for the sensor fleet and data pipeline have grown faster than the project can sustain on its current footing. We've paused new ingest and most live services while we re-evaluate the infrastructure and funding model. Historical data is preserved and the team intends to resume once a sustainable plan is in place.
Attackers change networks. They can't change their tools.
A passive sensor fleet watching internet background radiation, cataloging the TLS and SSH fingerprints that survive IP rotation. Everything below is what our sensors observed in the last 24 hours.
- 0
- New attacker IPs
- 200+
- Subnet sweeps
- 200+
- Tool clusters
- 13
- Unique JA4s
What our sensors saw today
Raw counts from the sensor fleet. Full dataset behind the dashboard.
104.23.175.0·AS13335- 249
- IPs
- 1,899
- Events
- 1h UTC
- Window
t12i130500_2d7513195f68_e51b7354d87f- 157
- IPs
- 102
- /24s
- 5
- ASNs
- 202
- Events
- :5900VNC2,179 events
- :445SMB1,482 events
- :2222SSH-alt551 events
- :23Telnet396 events
- :5432Postgres220 events
- AS14061DIGITALOCEAN-ASN13 IPs
- AS63949AKAMAI-LINODE-AP Akamai Connected Cloud8 IPs
- AS16509AMAZON-024 IPs
- AS137718VOLCANO-ENGINE Beijing Volcano Engine Technology Co., Ltd.3 IPs
- AS51396PFCLOUD3 IPs
Ground truth,
everywhere at once.
High-interaction honeypots in global datacenters. Known infrastructure, known operator — the canonical baseline every community report is measured against.
Thousands of volunteer sensors on home networks and small clouds. IP diversity no single vendor can buy, anonymized at ingest, cross-validated against Core.
Contributors get it free. Consumers fund the core.
A spare Pi, a VPS, or the old laptop in your closet earns you full Pro API access in 48 hours. JA3, cluster attribution, 90-day history.
No hardware? Your $19 funds a Core honeypot in the BoarNet fleet. The sensor pays for itself feeding the data you use — full Pro access in return: JA4, 180-day history, malware corpus, real-time DSL search.