Statistics
Aggregate threat landscape data from the BadBot Gateway platform.
Live
32,111
Blocklist IPs
7,004,146
Abuse Reports
183
Countries Seen
8
Categories With Reports
Activity Summary
| Metric | Last 24 h | Last 7 d | Last 30 d |
|---|---|---|---|
| Reports received | 46,949 | 319,984 | 1,561,720 |
| New indicators | 1,391 | 5,868 | 14,995 |
| Trap events | 46,949 | 320,003 | 1,561,737 |
Daily Trend
Indicators seen for the first time, and trap events received, per UTC day over the last 14 days. Today is partial.
New indicators
peak 1,572
10-13
10-26
Trap events
peak 64,224
10-13
10-26
Honeypot Activity
Received from the sensor fleet in the last 30 days: 1,561,737 trap events.
18,588
Unique attacking IPs
115,640
Unique fingerprints
61,861
Credential submissions (28,538 distinct)
88,619
Followed robots.txt disallows
311,107
Scanner user agents
872,025
Burst requests
113
Destructive methods (PUT/PATCH/DELETE)
84.0
Events per attacking IP
Most-hit traps
catch-all-config
213,109 (13.6%)
xmlrpc
212,475 (13.6%)
catch-all-scan
206,793 (13.2%)
catch-all-script
186,612 (11.9%)
catch-all-suspicious
145,979 (9.3%)
git-probe
121,509 (7.8%)
wp-login
117,110 (7.5%)
wp-admin
54,018 (3.5%)
wp-content
44,273 (2.8%)
catch-all-cms
24,287 (1.6%)
Top 10 Countries by Reports (last 30 days)
| # | Country | Reports |
|---|---|---|
| 1 | US | 402,818 |
| 2 | SG | 382,757 |
| 3 | NL | 140,263 |
| 4 | FR | 138,929 |
| 5 | BG | 138,094 |
| 6 | IN | 69,674 |
| 7 | DE | 36,812 |
| 8 | CA | 29,041 |
| 9 | PK | 24,297 |
| 10 | IT | 20,810 |
Top 10 ASNs by Reports (last 30 days)
| # | ASN | Organization | Reports |
|---|---|---|---|
| 1 | 396982 | Google LLC | 358,542 |
| 2 | 8075 | Microsoft Corporation | 200,966 |
| 3 | 48090 | Techoff Srv Limited | 130,798 |
| 4 | 211590 | Bucklog SARL | 122,930 |
| 5 | 31898 | Oracle Corporation | 122,518 |
| 6 | 218785 | — | 120,602 |
| 7 | 14061 | DigitalOcean, LLC | 23,685 |
| 8 | 24940 | Hetzner Online GmbH | 19,744 |
| 9 | 399486 | 12651980 CANADA INC. | 17,930 |
| 10 | 200373 | 3xK Tech GmbH | 17,022 |
Category Breakdown
Scanning
3,451,566 (49.3%)
Web Stack Probe
1,608,717 (23.0%)
Config Exposure Probe
1,392,793 (19.9%)
Credential Stuffing
206,692 (3.0%)
Admin Panel Probe
169,117 (2.4%)
API Probe
167,559 (2.4%)
Web App Attack
5,296 (0.1%)
Web Probe
2,406 (0.0%)
Risk Distribution
Based on 40,557 indicators with reports in the last 90 days.
19,294
Low (0–24)
7,134
Medium (25–49)
3,391
High (50–74)
10,738
Critical (75–100)