Feast Flow Labs Home
Live · updated 11:39 UTC

Threat Watch

This site has no login, no WordPress and no database. Even so, automated scanners knock on it every day, looking for weaknesses that every public website gets tested for. Here is what the last 30 days looked like.

449probes in the last 30 days
96distinct sources
22countries
40decoy keys taken
15.0probes a day on average
4.7requests per source on average
8sources that came back on another day
24 min agosince the last probe

Attacks arriving in the UK

Each line runs from a country probes came from to the UK, shown at London. The thicker the line and the bigger the dot, the more distinct sources. Click a line or dot to see what that country's scanners were after.

London

ATAustria

1 source · 1 request

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server1

1 source took a decoy key · last seen 11 days ago

CHSwitzerland

1 source · 1 request

  • WordPresslooking for WordPress logins and its remote-control interface1

last seen 3 days ago

ESSpain

1 source · 8 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server6
  • Source-code leakstrying to download a site's Git history, which often holds passwords2

1 source took a decoy key · last seen 14 days ago

FIFinland

1 source · 14 requests

  • Source-code leakstrying to download a site's Git history, which often holds passwords6
  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server4
  • Admin pageslooking for admin and control panels1
  • Backups and database dumpslooking for leftover backup archives and SQL dumps1

1 source took a decoy key · last seen 2 days ago · 2 more kinds of probe

ZASouth Africa

1 source · 1 request

  • Admin pageslooking for admin and control panels1

last seen 8 h ago

LTLithuania

2 sources · 6 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server5
  • WordPresslooking for WordPress logins and its remote-control interface1

last seen 11 days ago

RORomania

2 sources · 3 requests

  • Source-code leakstrying to download a site's Git history, which often holds passwords3

last seen 9 days ago

TWTaiwan

2 sources · 15 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server13
  • Source-code leakstrying to download a site's Git history, which often holds passwords2

2 sources took a decoy key · last seen 8 days ago

BEBelgium

3 sources · 37 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server30
  • Source-code leakstrying to download a site's Git history, which often holds passwords5
  • Admin pageslooking for admin and control panels1
  • Server internalsprobing server status pages and debug APIs that leak settings1

2 sources took a decoy key · last seen 49 min ago

BRBrazil

3 sources · 35 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server31
  • Source-code leakstrying to download a site's Git history, which often holds passwords4

3 sources took a decoy key · last seen 12 days ago

INIndia

3 sources · 7 requests

  • Server internalsprobing server status pages and debug APIs that leak settings3
  • Admin pageslooking for admin and control panels2
  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server1
  • Source-code leakstrying to download a site's Git history, which often holds passwords1

1 source took a decoy key · last seen 4 days ago

KRSouth Korea

3 sources · 3 requests

  • Admin pageslooking for admin and control panels3

last seen 15 days ago

PLPoland

3 sources · 18 requests

  • WordPresslooking for WordPress logins and its remote-control interface9
  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server6
  • Source-code leakstrying to download a site's Git history, which often holds passwords3

1 source took a decoy key · last seen 10 days ago

AUAustralia

4 sources · 6 requests

  • WordPresslooking for WordPress logins and its remote-control interface4
  • Admin pageslooking for admin and control panels2

last seen 2 days ago

GBUnited Kingdom

4 sources · 13 requests

  • Server internalsprobing server status pages and debug APIs that leak settings6
  • WordPresslooking for WordPress logins and its remote-control interface3
  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server2
  • Source-code leakstrying to download a site's Git history, which often holds passwords2

1 source took a decoy key · last seen 4 days ago

CACanada

5 sources · 36 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server23
  • Server internalsprobing server status pages and debug APIs that leak settings6
  • Source-code leakstrying to download a site's Git history, which often holds passwords5
  • Admin pageslooking for admin and control panels2

2 sources took a decoy key · last seen 8 days ago

FRFrance

8 sources · 66 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server26
  • Source-code leakstrying to download a site's Git history, which often holds passwords20
  • WordPresslooking for WordPress logins and its remote-control interface7
  • Backups and database dumpslooking for leftover backup archives and SQL dumps5

3 sources took a decoy key · last seen 16 h ago · 3 more kinds of probe

NLNetherlands

8 sources · 21 requests

  • Server internalsprobing server status pages and debug APIs that leak settings6
  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server4
  • Source-code leakstrying to download a site's Git history, which often holds passwords4
  • WordPresslooking for WordPress logins and its remote-control interface4

2 sources took a decoy key · last seen 24 min ago · 2 more kinds of probe

SGSingapore

9 sources · 43 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server29
  • Source-code leakstrying to download a site's Git history, which often holds passwords7
  • WordPresslooking for WordPress logins and its remote-control interface5
  • Admin pageslooking for admin and control panels1

4 sources took a decoy key · last seen 2 days ago · 1 more kind of probe

DEGermany

15 sources · 57 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server38
  • Source-code leakstrying to download a site's Git history, which often holds passwords10
  • Server internalsprobing server status pages and debug APIs that leak settings5
  • WordPresslooking for WordPress logins and its remote-control interface2

10 sources took a decoy key · last seen 54 min ago · 2 more kinds of probe

USUnited States

17 sources · 56 requests

  • Secrets and keyshunting for .env files, cloud keys and SSH keys left on a server19
  • Source-code leakstrying to download a site's Git history, which often holds passwords14
  • Server internalsprobing server status pages and debug APIs that leak settings13
  • Admin pageslooking for admin and control panels5

6 sources took a decoy key · last seen 8 h ago · 1 more kind of probe

Source countryUnited Kingdom
  • United Statestop source country
  • Australiafurthest away, about 15,200 km
  • 4,900 kmaverage distance to the UK
  • 4sources inside the UK

Probes per day

Requests for pages that don't exist and that no real visitor asks for. Hover a day for its count.

6 Oct: 0 requests7 Oct: 0 requests8 Oct: 0 requests9 Oct: 0 requests10 Oct: 0 requests11 Oct: 0 requests12 Oct: 0 requests13 Oct: 6 requests14 Oct: 44 requests15 Oct: 2 requests16 Oct: 22 requests17 Oct: 15 requests18 Oct: 19 requests19 Oct: 48 requests20 Oct: 27 requests21 Oct: 44 requests22 Oct: 5 requests23 Oct: 28 requests24 Oct: 27 requests25 Oct: 0 requests26 Oct: 5 requests27 Oct: 17 requests28 Oct: 0 requests29 Oct: 1 request30 Oct: 39 requests31 Oct: 12 requests1 Nov: 1 request2 Nov: 61 requests3 Nov: 11 requests4 Nov: 15 requests
6 Oct21 OctToday

Busiest day: 2 Nov, with 61 probes.

Show as a table
DayProbes
4 Nov15
3 Nov11
2 Nov61
1 Nov1
31 Oct12
30 Oct39
29 Oct1
28 Oct0
27 Oct17
26 Oct5
25 Oct0
24 Oct27
23 Oct28
22 Oct5
21 Oct44
20 Oct27
19 Oct48
18 Oct19
17 Oct15
16 Oct22
15 Oct2
14 Oct44
13 Oct6
12 Oct0
11 Oct0
10 Oct0
9 Oct0
8 Oct0
7 Oct0
6 Oct0

What they were after

Each probe grouped by the weakness it was testing for.

  • Secrets and keys239
  • Source-code leaks88
  • Server internals45
  • WordPress43
  • Admin pages22
  • Backups and database dumps10
  • Database admin panels2

Where they came from

Distinct sources by country, as reported by our network edge. Attackers often route through rented servers, so this shows where the machines are, not the people.

  • USUnited States17
  • DEGermany15
  • SGSingapore9
  • FRFrance8
  • NLNetherlands8
  • CACanada5
  • AUAustralia4
  • GBUnited Kingdom4

Plus 27 sources from 14 other countries.

Time of day

All probes in the period by hour (UK time). Scanners are automated, so they don't keep office hours.

00:00–01:00: 1 request01:00–02:00: 5 requests02:00–03:00: 10 requests03:00–04:00: 5 requests04:00–05:00: 9 requests05:00–06:00: 5 requests06:00–07:00: 32 requests07:00–08:00: 38 requests08:00–09:00: 18 requests09:00–10:00: 38 requests10:00–11:00: 26 requests11:00–12:00: 24 requests12:00–13:00: 38 requests13:00–14:00: 2 requests14:00–15:00: 7 requests15:00–16:00: 35 requests16:00–17:00: 16 requests17:00–18:00: 19 requests18:00–19:00: 35 requests19:00–20:00: 6 requests20:00–21:00: 30 requests21:00–22:00: 24 requests22:00–23:00: 16 requests23:00–00:00: 10 requests
00:0006:0012:0018:0024:00

Busiest hour: 07:00–08:00, with 38 probes.

Recent activity

The latest sources, one line each.

  • 24 min agoAdmin pagesNLNetherlands
  • 24 min agoBackups and database dumps · 2 requestsNLNetherlands
  • 24 min agoSource-code leaksNLNetherlands
  • 24 min agoSecrets and keysNLNetherlands
  • 49 min agoSecrets and keys · 4 requestsBEBelgium
  • 49 min agoSource-code leaksBEBelgium
  • 49 min agoServer internalsBEBelgium
  • 49 min agoAdmin pagesBEBelgium

How this works

The same monitoring we set up for clients, running on our own site.

Bait

Addresses that look valuable to an attacker but don't exist. Nobody with a legitimate reason asks for them, so every request is a scanner.

Decoys

Anyone who goes looking for passwords or keys finds one that looks real but unlocks nothing. If they try to use it, we're alerted.

Response

We get an alert within seconds, and persistent sources are reported to the abuse desk of the network they came from. We never hit back.

Want to know what's probing your business? See our security reviews.