HONEYNET // live threat console

◉ origin map

⚡ live feed

last 60 events

📈 attacks / hour (24h)

🌍 top countries

🔑 top passwords

👤 top usernames

🎯 user / pass combos

💻 commands run

📡 top source IPs

🛠 attacker clients

🦠 malware samples captured

🔗 most-fetched payload urls

⬇ malware fetch commands

📜 latest session transcript

⏱ longest sessions

🔌 protocol split

🏢 top attacker networks (asn)

🆕 freshly seen attackers

🧬 hassh client fingerprints

🧰 attacker command intent

🧪 malware intel

static analysis · no execution

🛰 malware c2 infrastructure

from downloads + fetch commands

🕸 attack campaigns (shared infrastructure)

clustered by shared payload or c2 host · components ≥ 2 ips