SENTRY INTEL

tarpit telemetry · attacker-side
loading dataset…

Attacker endpoints

URLs found inside the bytes the attacker sent — endpoints they actually tried to pull a payload or push data to. These are real callbacks.

hitsendpoint

Scanner self-identifiers

URLs that appear only in a client's User-Agent, never in payload bytes — crawlers and research scanners announcing themselves. Not callbacks.

hitscrawler identifier

Load over time

Protocol mix sensor wire protocol

Attacker geography per-subnet /24 cluster — real coords, offline-resolved

Top attack paths nginx decoy hits — web attack surface

Sensor event mix

Honeypot client type mix

Tool fingerprints client library / user-agent

fingerprintevents

Credential capture

timestampsource ipprotousercc

Decoy access keys captured honeytoken value exfiltrated by attackers

Recent sessions

timestampsource ipccport protoeventtoolpath

Payload inspector pick a captured session — raw bytes ↔ decoded text

raw hex — payload_hex field


          

          

            
byte hex — derived (utf-8)

            

          

          

            
decoded text — payload_text field

            

          

        

        
Literal \n sequences render as typed. The
          payload_hex pane carries the captured payload string exactly as the
          extractor wrote it; the derived byte-hex pane is the same bytes encoded UTF-8, so a hash or grep against the
          source log verifies byte-for-byte. An empty pane means no payload bytes were captured for that connection.

      

    

  


  
  

    

      
Top source subnets /24 cluster centroid

      

        

          
subnetcceventsips
          latlon

          

      

    

    

      
Top source IPs

      

        

          
ipcountrycityevents
          latlon

          

      

    

  


  
  

    

      
Source files & digests sha256 per sensor log

      

        

          
filebytessha256

          

      

      

        

      

    

    

      
Provenance & method