BoarNet is on hiatus.
Operating costs for the sensor fleet and data pipeline have grown faster than the project can sustain on its current footing. We've paused new ingest and most live services while we re-evaluate the infrastructure and funding model. Historical data is preserved and the team intends to resume once a sustainable plan is in place.
Attackers change networks. They can't change their tools.
A passive sensor fleet watching internet background radiation, cataloging the TLS and SSH fingerprints that survive IP rotation. Everything below is what our sensors observed in the last 24 hours.
- 0
- New attacker IPs
- 0
- Subnet sweeps
- 0
- Tool clusters
- 0
- Unique JA4s
What our sensors saw today
Raw counts from the sensor fleet. Full dataset behind the dashboard.
Ground truth,
everywhere at once.
High-interaction honeypots in global datacenters. Known infrastructure, known operator — the canonical baseline every community report is measured against.
Thousands of volunteer sensors on home networks and small clouds. IP diversity no single vendor can buy, anonymized at ingest, cross-validated against Core.
Contributors get it free. Consumers fund the core.
A spare Pi, a VPS, or the old laptop in your closet earns you full Pro API access in 48 hours. JA3, cluster attribution, 90-day history.
No hardware? Your $19 funds a Core honeypot in the BoarNet fleet. The sensor pays for itself feeding the data you use — full Pro access in return: JA4, 180-day history, malware corpus, real-time DSL search.