The OpenCanary Experience · Open for Business

In 2024 the internet stopped knocking — and moved in.

Sixty-eight million connection attempts across three sensors. And the open file share I built as a tripwire? The internet started using it as a depot. This is the year the experiment went industrial.

Scroll, swipe, or use the arrow keys.

The scale · all of 2024

Sixty-eight million.

Total connections

across three sensors, eleven protocols

Days active

366

every single day of a leap year — no gaps

Peak day

23 August 2024

Unique sources

distinct hosts that knocked

Genesis logged ten million in a quarter. 2024 logged nearly seven times that in a year — and never stopped, not for one hour of one day.

The fleet, grown up

Six scrappy nodes became three serious sensors.

Gone were the half-named cloud experiments of 2023. By 2024 the flock was three steady sensors carrying an almost equal third of the load each — a measurement rig, not a workbench.

US-East24,296,439

Switzerland24,016,971

US-West21,646,541

Three sensors, three continents' worth of exposure, and they saw the same internet — the same protocols, the same tooling, the same relentless volume. Where the canary sits barely changes who comes looking.

2024 · protocol detail

The crosshairs moved.

RDP · 338922,460,278

MSSQL · 143318,662,544

SSH · 2216,016,453

VNC · 59018,127,227

Telnet · 232,205,960

Redis · 6379433,520

MySQL · 3306161,205

FTP · 21124,747

HTTP · 8029,340

GIT · 9418359

RDP dethroned SSH

In Genesis, SSH led. In 2024, RDP took the crown at 22.5M — the internet hunting for desktops, not just shells. Remote access still ruled, but the target had shifted.

Databases in the crosshairs

MSSQL leapt to number two — 18.7M attempts, more than SSH. Hourly volume never dipped below 2.8M. A flat line, around the clock: machines, not people.

Who came knocking

A bigger map, a single monster.

Geography

China 10,061,658 · United States 9,765,322 · South Korea 8,827,691 · Belgium 8,258,019. Korea and Belgium are the new heavyweights — and the Belgian volume is one hosting range, not a country.

The monster

A single Korean IP — 220.120.147.167 — fired 7,121,989 hits by itself. One host, more than 10% of everything the three sensors saw all year.

The farm

The 194.169.175.x block fills nine of the top twenty sources — a coordinated cluster grinding away. And 185.73.125.23, the worst VNC offender of 2023, was back for 1,031,655 more.

The VNC paradox, again

8,127,227 VNC connections. Passwords that matched a known list: 126,332 — 27× more hits than 2023, yet still 98% failure. Brute force against a wall, at industrial volume.

The tyranny of the default · 2024

Same dumb keys — and a new door.

The Known Dumb Credentials never changed; there were just millions more of them. But a new target appeared in the top of the list: the default logins of home fibre routers.

🦠 The keys they tried most

Username	Password	Attempts
admin	admin	179,451
root	root	58,580
root	vizxv	48,393
root	xc3511	44,077
telecomadmin	admintelecom	28,684
e8telnet	e8telnet	21,824

vizxv and xc3511 are Mirai's IoT defaults. telecomadmin/admintelecom is the factory login on Huawei fibre terminals; e8telnet is ZTE's. In 2024 the botnets came hunting the box in your living room.

What really happened

I left the share open. The internet moved in.

In 2023 a December trickle dropped one binary 53 times. In 2024 the same campaign industrialised — across all three sensors, every day of the year.

Files written

random-named .exe drops

Dropper IPs

vs 20 in 2023

Write operations

create_file · overwrite_if

Window

Every day

1 Jan → 31 Dec 2024

103.158.127.113 (SMB3_00, "OSX") create_file overwrite_if ok — 18,050 files
186.10.23.226 (SMB3_00, "OSX") create_file overwrite_if ok — 2,550 files
…3,739 IPs, the same spoofed SMB3_00 / OSX fingerprint, all year

2023 → 2024 · what we kept

2023: one binary, 57 times — SHA-1 23873bf2… (RemCom)

2024: 31,596 files — too many to keep. Every delivery logged; the parcels themselves purged for space.

Sentinel alone absorbed 56,558 drops. The token was never the prize. The share itself was: free, anonymous, internet-facing storage for the internet's break-in tools. Sadly for the criminals, my "antivirus" solution moved their file. Immediately.

Open for Business

An open share isn't probed. It's used.

Sixty-eight million knocks. Every hour of every day.

They came hunting the default password on your router.

And stayed to store their tools on your open share.

A tripwire became a depot. The internet didn't just test the door — it walked in and unpacked. This was the year the experiment went industrial.

By 2026, the flock had grown again — and so had what it saw.

The OpenCanary Experience →