knock-knock.net

Writing and Resources

Writing, observations, and live data from a multi-protocol honeypot.

Writing and Observations

Citigroup, Idaho, and Build-A-Bear Launched a Coordinated Attack on Me August 5, 2026 A surprising collection of institutional networks tried to relay toll-fraud calls through my honeypot in four coordinated waves. Here's how to check if any of these attacks, or others captured by this honeypot, originated on your network. Promiscuous Hosting Services August 30, 2026 Hosting services could easily identify botnet hosts on their own networks, but many don’t bother. Seeing and Hearing Internet Background Radiation Live observation A guided look at the constant background noise reaching ordinary internet-facing services.

Knock-Knock Resources

Live Honeypot The live dashboard showing attacks as they arrive across supported protocols. Source Code The open-source Knock-Knock honeypot project. How Knock-Knock Works A step-by-step explanation of the system and what the live dashboard is showing. Knock-Knock API Check whether your IPs, ranges, or ASNs appear in the honeypot data. Blocklists Monthly and yearly attacker-IP blocklists, plus live feed links for defensive use.