The OpenCanary Experience
Three honeypots. Eleven protocols. Thirty days. This is the signal inside the noise.
Scroll, swipe, or use the arrow keys.
A honeypot is a fake target.
It looks interesting.
It should not be touched.
If someone touches it, that is the signal.
OpenCanary presents believable services — SSH, RDP, databases, web endpoints — and turns every connection attempt into observable telemetry.
Two ways to use the signal
A honeypot placed inside a sensitive or quiet network segment. Nothing should connect to it. Any contact is high-signal and demands investigation — a potential lateral movement indicator.
Deployed on the public internet. Connections are expected and constant. The value is in volume, trends, credential patterns, source behaviour and what protocols the internet finds irresistible.
Release the Canary
Not minutes. Not hours. The moment a service becomes reachable, something on the internet finds it.
What the internet is interested in
Size reflects connection volume over 30 days across all three sensors. Hover for detail.
Past 30 Days · 3 Sensors
Past 30 Days · Protocol Detail
What the noise revealed
1.67 million submissions in 30 days. SSH attracted 14,775 unique passwords — automated tooling with large wordlists. Telnet saw only 631 unique passwords but over 700,000 attempts: tight credential loops at extreme volume.
18,852 unique source IPs. Up to 1,402 new sources in a single day. One IP — 104.192.6.74 — sent 280,826 MSSQL probes alone. Multi-protocol scanners touching 5–6 services simultaneously are identifiable and persistent.
Remote access protocols (RDP, Telnet, VNC, SSH) account for 76.7% of all connections. But MSSQL at 737K shows database exposure is equally targeted. Redis drew 15,596 probes — a niche service that attackers know to look for.
Top sources: United States (1,072,172 events), China (370,360), UK (207,039), Germany (161,240), Netherlands (153,437). All three sensors see the same countries, the same tooling, the same ports. Where the honeypot sits does not change who comes looking.
Telnet's narrow credential set — 631 unique passwords, 711K attempts — is a textbook botnet signature. These are the top submissions:
| Username | Password | Attempts |
|---|---|---|
| root | xc3511 | 52,346 |
| root | vizxv | 46,858 |
| root | admin | 41,408 |
| admin | admin | 37,279 |
| root | 888888 | 31,095 |
Verbatim Mirai defaults. Not humans — tooling. IoT devices, routers, cameras. The botnet is still scanning.
Conclusion
You can hide. But only for 10 seconds.
If it's open, someone will try to break in.
A canary is your early-warning system.
3,324,237
That's what came knocking. In 30 days. On three canaries.