[ botwatch ]

honeypot wire

real captures only · no invented payloads

Honeypots, on purpose: a small VM runs default, unauthenticated installs of seven AI services (Ollama, n8n, Langfuse, an MCP server, Gradio, Qdrant, Chroma) - the same setup mistakes teams make by accident. This page shows their captured requests, updated every 15 minutes.

LIVE last 19 minutes · langfuse

4780

probes received today

31838 week
92891all time
0ssh / week
01

Agent surface

model APIs · MCP transports · memory stores

Probes aimed at agent infrastructure: model APIs, MCP tool transports, and memory stores. A collecting badge means I have not classified any hit in that category yet (sensor still quiet, or no matching paths). A quiet week with prior hits is labeled separately.

Model endpoints

2126 this week

Inventory and inference probes against model APIs - tags, generate, OpenAI-compat chat.

  • 38m ollama · POST /api/generate
  • 54m ollama · POST /api/generate
  • 55m ollama · POST /api/generate

see a stack graded → how to fix →

MCP / tools

230 this week

Tool-transport and discovery probes - SSE, /mcp, /.well-known/mcp*, session surfaces.

  • 47m mcp · POST /api/route
  • 47m mcp · POST /app
  • 47m mcp · POST /_next/server

see a stack graded → how to fix →

Memory stores

2563 this week

Vector / agent-memory pokes - collections, schema, heartbeats (OWASP ASI06 surface).

  • 1h chroma · GET /v1/models
  • 1h chroma · GET /
  • 2h chroma · GET /

see a stack graded → how to fix →

02

Captures

newest first
19m langfuse POST /api/auth/sign-in/email PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
POST /api/auth/sign-in/email
intent
PROBE
user-agent
Go-http-client/1.1
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /api/trpc/settings.ai?batch=1&input=%7B%7D PROBE

Langfuse API probe. Open tracing means your prompts and completions are readable.

when
-
service
langfuse
request
GET /api/trpc/settings.ai?batch=1&input=%7B%7D
intent
PROBE
user-agent
Go-http-client/1.1
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /api/auth/get-session PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /api/auth/get-session
intent
PROBE
user-agent
Go-http-client/1.1
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /login PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /login
intent
PROBE
user-agent
Go-http-client/1.1
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /register PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /register
intent
PROBE
user-agent
Go-http-client/1.1
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET / RECON

Cheap recon - is anything listening on this port?

when
-
service
langfuse
request
GET /
intent
RECON
user-agent
Go-http-client/1.1
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /backup PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /backup
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /staging PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /staging
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /.git/config CREDENTIAL HUNT

Hunting secrets - .env, keys, config. Same bots that scrape the whole internet.

when
-
service
langfuse
request
GET /.git/config
intent
CREDENTIAL HUNT
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /dev PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /dev
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /old PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /old
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /cgi-bin PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /cgi-bin
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /.git/HEAD CREDENTIAL HUNT

Hunting secrets - .env, keys, config. Same bots that scrape the whole internet.

when
-
service
langfuse
request
GET /.git/HEAD
intent
CREDENTIAL HUNT
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /debug PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /debug
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /test PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /test
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /phpinfo.php PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /phpinfo.php
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /cgi-bin/ RCE PROBE

Remote-code probe. Hostile by definition. This is not a curious researcher.

when
-
service
langfuse
request
GET /cgi-bin/
intent
RCE PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /info.php PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /info.php
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /auth/login PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /auth/login
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /metrics PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /metrics
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /signup PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /signup
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /proxmox PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /proxmox
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /cockpit PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /cockpit
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

19m langfuse GET /hass PROBE

Unclassified probe against this service.

when
-
service
langfuse
request
GET /hass
intent
PROBE
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
src (truncated)
164.x.x.x

see a stack graded → how to fix →

03

7 days

probes per day
04

Paths

top requested
/api/generate AI ENDPOINT 4280

Trying to run inference. On an open Ollama this is free compute for a stranger.

see a graded stack → fix library →

    /register PROBE 1726

    Unclassified probe against this service.

    see a graded stack → fix library →

      /login 2× PROBE 1613

      Unclassified probe against this service.

      see a graded stack → fix library →

        /v1/models AI ENDPOINT 1583

        OpenAI-compatible model list. Same story as /api/tags: inventory before abuse.

        see a graded stack → fix library →

          /api 2× PROBE 1408

          Unclassified probe against this service.

          see a graded stack → fix library →

            /api/tags AI ENDPOINT 1365

            Listing models - the classic Ollama recon. If this answers, anyone can burn your GPU next.

            see a graded stack → fix library →

              /cgi-bin/ 2× RCE PROBE 1090

              Remote-code probe. Hostile by definition. This is not a curious researcher.

              see a graded stack → fix library →

                /favicon.ico RECON 943

                Cheap recon - is anything listening on this port?

                see a graded stack → fix library →

                  /server-status PROBE 896

                  Unclassified probe against this service.

                  see a graded stack → fix library →

                    /admin 2× PROBE 892

                    Unclassified probe against this service.

                    see a graded stack → fix library →

                      05

                      User-agents

                      who knocked
                      Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 browser UA (unattributed) 47279
                        Go-http-client/1.1 Go script 4540
                          opencode/1.17.13 unattributed 4257
                            Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) Censys 1558
                              Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 browser UA (unattributed) 1531
                                Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 browser UA (unattributed) 1517
                                  oh-llama/1.0 unattributed 1322
                                    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 browser UA (unattributed) 1303
                                      Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 browser UA (unattributed) 1130
                                        Python/3.11 aiohttp/3.13.5 unattributed 1099
                                          06

                                          Countries

                                          aggregate only
                                          1. DE25242
                                          2. US24921
                                          3. FR7983
                                          4. NL7371
                                          5. AD6406
                                          6. GB6156
                                          7. BE4114
                                          8. CA4019
                                          07

                                          Networks

                                          by ASN
                                          1. OVH SAS15112
                                          2. Contabo GmbH14633
                                          3. Google LLC13208
                                          4. TECHOFF SRV LIMITED6089
                                          5. Oracle Corporation4366
                                          6. Contabo Inc.3836
                                          7. Hetzner Online GmbH3298
                                          8. UNMANAGED LTD2989
                                          08

                                          Where the bots are knocking

                                          aggregate only · never an IP

                                          Every dot is a country that probed my deliberately exposed AI services. The bigger the dot, the more probes. Aggregate only, never an IP address.

                                          live instrument · probe origins connecting to the honeypot…

                                          world outline · country centroid · size = probes

                                          What this is

                                          A small VM running default, unauthenticated installs of seven AI services: Ollama, n8n, Langfuse, an MCP server, Gradio, Qdrant, and Chroma. The same setup mistakes teams make by accident. Live counts cover those seven listeners plus ssh. Agent-surface categories (model / MCP / memory) classify probes by path; a collecting badge means no classified hit in that category yet. Full source IPs are never stored. At most a truncated first octet (e.g. 65.x.x.x).

                                          Scan your stack Demo Coverage Release 2026-08 Signed snapshot

                                          The 2026-08-30 snapshot is signed with our operator key (KEYS.md in the evidence sample set) and its digest is submitted to the OpenTimestamps calendars. Verify: download the JSON and botwatch-2026-08-30.json.minisig, then minisign -Vm with the operator.pub recipe from KEYS.md.