Deception Check Fleet Status

Deception Check Fleet Status is a public-facing threat intelligence dashboard that aggregates and displays real-time observations from a global honeypot fleet operated by Deception Check. The data is batch-updated every 6 hours and delayed by at least 24 hours by design to avoid exposing live capture operations. The dashboard presents aggregated, measured data — not modeled or estimated — across several dimensions: Threat Index & Volume: - A 24-hour threat index score with severity classification - Total event counts and unique IP counts per 24-hour window - Coverage across 20+ protocols, 6+ continents, and 24+ emulated device/service profiles Attack Origin Intelligence: - Geographic breakdown of observed connection sources by country and region - Visual global map of attack origins sized by share of observed traffic - Clear disclaimer that origin reflects packet source, not attribution Protocol Breakdown: - Distribution of observed attack traffic across protocols including RDP, SSH, Telnet, SSL-VPN, HTTP, and OT/ICS protocols such as SCADA-Modbus, DICOM, BACnet, DNP3, EtherNet/IP, GE-SRTP, VNC, LDAP, and MSRPC MITRE ATT&CK Technique Classification: - Auto-classification of observed sessions into ATT&CK techniques including T1110 (Brute Force), T1059, T1190, T1021, T1082, T1105, T1071, T1003, and T1070 Credential Canary / Token Detonation: - Tracks bait credentials planted across decoys - Records IPs that attempted to use stolen credentials - Tracks detonation events where stolen tokens were used elsewhere on the internet - Identifies cross-IP credential reuse incidents Capture Feed: - Replays recent honeypot sessions with a minimum 24-hour delay and identifying details redacted - Filters nuisance scanners to improve signal fidelity Most-Tried Credentials: - Lists the top username/password combinations attempted against honeypot systems in the last 24 hours