Tools
Attack replay theatre
Two minutes of pretend attacks on a pretend server, with commentary.
Synthetic lab data, not real traffic. Every event was made by a script. Addresses are reserved documentation ranges and source countries are assigned at random, so nothing here says anything about real places or people.
Filter by attack type
Event log
How to read this
The yellow dot on the map is a fictional sensor, a decoy server that nobody should ever visit, so every visit is suspicious. Each line is one event flying in from its source country. Use the filters to follow one attack type, and the speed buttons to slow a burst down. The vocabulary (SSH brute force, credential stuffing, Log4Shell and so on) comes from the kinds of events a honeypot classifier labels; none of the data does.
Data sources & privacy
No third-party calls. The land shapes are Natural Earth data (public domain), the events come from replay.json in this folder, and your choices are not stored anywhere.