The OpenCanary Experience: Genesis
11 October 2023. A canary went up on the open internet. It has been running, uninterrupted, ever since — the data growing past what one person's skills could search, and one tired machine could hold.
The Data Tsunami
Not a Splunk problem. A resource problem. Running in a VM on a decade-old Lenovo Haswell i7 with 16GB of RAM, Splunk could ingest the log data — but not report on those 176 million log entries.
Breakthrough
For a long time it just failed. Every query that reached for real volume resourced-out and died on the box — too much data, too little machine.
Then a mid-2025 Splunk upgrade changed how the events were stored, and even the exports that used to work stopped working.
That's where Claude Code came in. I'm the muse — the hunches, the direction, knowing which thread to pull. It's the worker — turning each call into batched, format-aware exports that actually finished.
The Eureka Moment
No schema notes. No hints about which port matters or which country to watch. Detailed to the letter for the extraction. Bare, abstract, almost nothing — for the meaning. That's the entire brief.
Ingestion. Digestion. Revelation.
23 Aug 2024: 1,310,610 connections in a single day — flagged as the anomaly it was, not averaged quietly away.
220.120.147.167 (South Korea) alone sent 10,659,664 hits — named as a singular, persistent actor, unprompted.
Verbatim Mirai botnet default credentials, called out without being told to look for Mirai:
| Username | Password | Attempts |
|---|---|---|
| admin | admin | 627,939 |
| root | vizxv | 78,481 |
| root | xc3511 | 72,294 |
6,915,582 SMB events, ~39,600 files received, and just 3 distinct malware binaries in 3.5 years — RemCom alone behind 99.96% of every drop.
Meet The Team
The intuition, the hunches, the inspiration — mine. The ability to deliver, unwaveringly, quickly and usually accurately — Claude.
Teamwork.
It knows everything.*
*But not which everything matters here. That's still the muse's job.
The VNC module's known-password list went from 6 entries to roughly 2,800. Not an exhaustive list — and pushing it higher asks questions of resources — but a big increase in the on-the-fly matching of VNC password attempts.
Evolution
What used to die mid-search is now a living record: complete back to day one, current as of today.
Then MongoDB scans started showing up — the internet hunting for exposed instances. So Claude Code and I built a MongoDB module for OpenCanary, and the pull request was accepted into the project everyone else runs too.
