HAKVAULT/
[ FIELD INTELLIGENCE / 001 ]

The internet never sleeps.

An open window into botnet infrastructure, observed scanning and documented cyber incidents. Follow the signal. Inspect the evidence.

CONNECTING TO SOURCES
Unique reported IPs
—Deduplicated across eight IP sources
IP geolocation countries
—DB-IP approximate locations
Scanning reports
—Sum across displayed top ports
Exploited vulnerabilities
—Known exploitation · CISA catalog
Filter by dateUTC dates

No date filter. Most reported IPs do not have an occurrence date.

Provider observation dates describe first-seen or last-online activity, not confirmed attack times. Download dates describe feed freshness. Historical incident dates are filtered separately.

3D GLOBE / DRAG TO ROTATE / APPROXIMATE LOCATIONS / CLUSTERED
Connecting to reported-IP feeds…
ATTRIBUTED CAMPAIGNS / HISTORICAL

City clustersCountry-onlyHistorical incident
1×
Drag to rotate the globe; scroll or pinch to zoom. Arrow keys and the navigation buttons also rotate. Markers cluster approximate IP locations, not individual attacks. Country-only locations are labelled. Click a dot to inspect its records. The inspector also lets you zoom to the location or filter by country.Awaiting feed response

Reported IP ledger

MULTI-SOURCE / DEDUPLICATED

Observed scanning

SANS / ISC

Top destination ports by reported packet count. Sensor observations, including benign research scans; not confirmed compromises.

Exploitation watchlist

CISA / KEV

Latest catalog additions first. Date added is not the date exploitation began. Full CISA catalog ↗

Know what you’re looking at.

FIELD NOTES
01 / Infrastructure is not attribution

A compromised server in a country tells you where infrastructure was reported. It doesn’t identify the attacker.

02 / A scan is not a breach

Internet sensors see probing, background noise and legitimate researchers. Packet reports are not a tally of successful attacks.

03 / Follow the timestamps

A fresh download can contain old observations. Always inspect last-online dates and source reporting windows.

04 / Incidents need context

The incident layer is a curated historical reference, not an automated breaking-news feed. Each entry links to an official source.

TURN CURIOSITY INTO CAPABILITY.

Understanding the signal is the first step. Explore HakVault for practical cybersecurity learning.

Enter HakVault ↗

Sources & methodology

This is an open intelligence observatory, not a global attack counter. No simulated live events or estimated attack speeds are shown. Attributed campaign arrows illustrate documented country relationships; they are not observed network routes. The slow sweep and marker pulses are decorative; they do not represent new attacks. Animation can be paused and respects reduced-motion preferences.

GreenSnow reports scanning and abuse. Emerging Threats lists reported compromised hosts. IPsum aggregates public lists; only IPs present in at least three underlying lists are included. IPsum list counts are not attack counts or independent confirmations; underlying sources can overlap with other feeds here. These feeds supply no per-IP occurrence dates. New IPs use country-only geolocation unless city enrichment is available.

4x0nn / SecKC MHN honeypot data

Source credit: 4x0nn. Data is fetched from the public SecKC MHN dashboard top-source-IP statistics endpoint, labelled by that dashboard as the last 24 hours. We retain report counts and honeypot types (for example Cowrie and Dionaea), deduplicate by IP, and apply our DB-IP location lookup. These are observations at participating honeypots, not confirmed successful attacks or verified attacker identities. This endpoint does not supply target locations or per-record event dates, so no source-to-target arrows or dates are invented. Cached for five minutes. The original dashboard credits Rob Scanlon / arscan for its visualization; this globe uses D3 and Natural Earth instead.

New reported-IP sources

blocklist.de: IPs reported within the last 48 hours; source regenerates every 30 minutes. We cache downloads for one hour. Individual event timestamps are not provided.

CINS Army: current threat-reputation list from Sentinel sensors and trusted sources. This list does not include individual event timestamps; a download time is not an attack time.

SANS ISC / DShield top source-IP feed: up to 100 source IPs from sensor reports. The returned list can be smaller. It can include legitimate security researchers; inclusion is not proof of malicious intent. Individual event times are not supplied. Attribution: SANS Technology Institute, Internet Storm Center, isc.sans.edu. Data is not resold here.

Deduplication & map clusters

IPv4 and IPv6 addresses are normalized and deduplicated across blocklist.de, CINS Army, DShield and Feodo. One IP may retain several sources. Map clusters represent groups of IPs at nearby approximate locations within the same country. Cluster centroids and country representative positions are labelled. Zooming reveals smaller clusters; there is no random scatter. Counts refer to IPs, not attacks.

IP Geolocation by DB-IP

IP Geolocation by DB-IP, CC BY 4.0. October 2026 Lite databases provide approximate city coordinates for the IPs present during enrichment, plus IPv4 and IPv6 country lookup for new IPs. City enrichment and database release dates appear in the inspector. New IPs without city enrichment fall back to an explicit country representative position. They are never scattered randomly. Geolocation accuracy varies and does not identify the attacker. City enrichment is bundled and must be rebuilt for newly appearing city locations; the threat feeds themselves refresh independently.

Feodo Tracker / abuse.ch

Botnet C2 indicators supply malware families, reported states and last-online dates. “Online” is the provider’s reported state, not an independent connection test. Feodo is a CC0 exception in the abuse.ch terms.

Scanning & exploited vulnerabilities

The SANS top-ports panel shows packet reports for the top 10 returned ports, including benign scanning. CISA’s official KEV mirror supplies vulnerabilities with evidence of exploitation. Neither panel is an incident counter.

Historical incident layer

Eight manually curated educational examples: Optus, WannaCry’s NHS impact, the US Department of Energy SolarWinds response, NotPetya, Olympic Destroyer, Georgian website attacks, Microsoft Exchange compromises affecting Australia, and the July 2022 attack on Albania’s government. Each record links to official disclosures or primary incident research. Country markers describe affected organizations, not attacker origins or the full extent of an incident. This layer does not auto-update.

Attributed campaign arrows

Seven campaign arrows use attribution from the UK Foreign Office / NCSC, the Australian Government and the US Treasury. Primary Microsoft research and US Justice Department records provide additional incident context. Click an arrow or campaign chip for the named actor, assessment language, publication date and evidence link. Arrows join country reference positions and show one affected country from a wider campaign. They do not represent live attacks, packet paths, verified launch locations or speed. Date filters use the displayed incident or disclosure date. Microsoft Exchange uses the Australian public disclosure date, 19 July 2021, not the start of exploitation; its inspector labels this explicitly. Later attribution publication dates are shown separately. IP source filters and IP-only layers hide these unrelated historical arrows. Campaign arrows and animation can be switched off separately; reduced-motion preferences are respected.

Freshness & availability

Feeds are fetched server-side on page visits, cached for one hour per running server instance (five minutes for MHN; one day for IPsum and Emerging Threats) (shared edge caching where supported) and checked every five minutes while this page is visible. Refresh respects that cache. If a reported-IP source is unavailable, a genuine bundled download can be used with an explicit SAVED SNAPSHOT label and its original download time. Snapshot entries do not become new events. Failed sources retry after five minutes. No scheduled background collection or live attack stream is implied.

Date filtering

Most IP lists do not provide individual occurrence dates. Observation-date filtering uses only Feodo first-seen / last-online dates and known historical incident dates. Undated IPs are excluded from an active observation-date filter unless you explicitly include them. Download-date filtering uses feed retrieval times and is labelled separately. Date ranges are inclusive and use UTC. Download times never stand in for attack dates.

Globe rendering

Interactive orthographic globe with hemisphere clipping, country boundaries, lakes, rivers, approximate IP clusters and great-circle campaign paths. Drag or touch to rotate, pinch or scroll to zoom, or use the keyboard and navigation buttons. D3 7.9.0, ISC license, is bundled locally. Globe lighting is decorative, not a real-time day/night terminator. Campaign lines are illustrative relationships.

Basemap

Generalized Natural Earth country boundaries via datasets/geo-countries ↗, public-domain source data. Higher-detail country boundaries, lakes, major rivers and populated-place labels use public-domain Natural Earth vector data. Place labels become visible as you zoom; labels are thinned to reduce overlap. Boundaries are illustrative. Historical incidents and country fallbacks use country reference positions; IP city locations are approximate DB-IP positions.

Map records