Total observations—every poke at the cardboard
ARACHNE OBSERVATORY 🕷️
The internet keeps poking the box.
Welcome to my server room. Fake admin panels, imaginary services, and a spider keeping track of the bots who try them anyway.
🕸️ cardboard façades🐈 real telemetry🍵 questionable amounts of tea
Connecting to the web…
server-room door: OPEN
Unique sources—counted, never identified here
Products & sensors—different flavours of fake
Activity types—many ways to be curious
THE SPIDER'S NOTEBOOK
What wandered in?
The internet keeps knocking. We keep taking notes.
$ tail -f attempts.log
First 10 per product, then repeats bundled by minute. Six quiet minutes reset it. SIP stays bundled. Times in UTC.
- Waiting for the next curious bot…
A TUG ON THE THREAD
Across the web
The spider felt the web move.
Listening to the webLAST 10 MINUTES
Country centres, never source locations. A brighter thread carries a group of observations. Showing up to 60 recent threads.
BUSY SPIDER, QUIET SPIDER
Activity over time
—observations in this view
Waiting for a signal…
Every observation counts. Even the thousandth unsolicited phone call. Max spans all stored data and uses wider buckets for longer histories.
KNOCK KNOCK
The Cardboard Door
The internet found the cardboard door.
Cowrie / SSH + Telnet—events / last 60 min
—events / last 24 hours
—fake logins accepted / last 24 hours
How they knocked 24h events
Waiting for a knock…
Every Cowrie event counts, from probes to commands. Accepted logins enter a cardboard computer.
PLEASE HOLD
Bots Callcenter
Apparently I am hosting a callcenter. Nobody has asked about my opening hours.
SentryPeer / SIP—requests / last 60 min
—requests / last 24 hours
The callers’ vocabulary 24h
The phone has been quiet.
Unsolicited SIP requests. The spider is not taking appointments.
KNOCK KNOCK
What the spiders found
All-time patterns from a neighbourhood of fake doors.
Products & sensors
The boxes attracting all this attention.
Target surfaces
Different doors. Same cardboard.
Activity types
What our visitors thought they were doing.
Methods & protocols
All the different ways to knock.
SURELY “ADMIN” WILL WORK THIS TIME
Credential nonsense
A peek at the guessing game, reduced to patterns.
Tried usernames
≥ 5 triesSubmitted usernames, treated as plain text.
Password lengths
The shape of a guess, without the guess itself.
Password hall of shame
Only a fixed list of common literals, matched against HMACs. At least 3 tries to earn a place.
QUIETLY TAKING NOTES
Who’s at the other end? p0f
Listening to TCP introductions, without saying hello.
passive network notes
—fingerprinted hosts
—observations
—hosts with fuzzy matches
—hosts with generic matches
OS families
Likely signatures
| Likely signature | Hosts | Distance | Match |
|---|---|---|---|
| No fingerprints observed yet. | |||
Targeted services
Observations and distinct hosts per port.
ⓘ OS values are estimates and may be generic or fuzzy. p0f listens to TCP; UDP traffic does not appear here.
BEHIND THE CARDBOARD
Cardboard façades.
Real telemetry.
Arachne is my collection of convincing fake doors: logins that go nowhere, imaginary installations, and services with absolutely no intention of being useful.
The bots keep trying. The spider keeps a notebook. The cat takes most of the credit.
This page does not expose source IPs, raw captured passwords, request bodies, or identifying request data. Usernames may appear as submitted; credential and network telemetry is otherwise reduced to aggregate patterns. The hall of shame contains only curated common literals.
$ systemctl status reality Unit reality.service could not be found. $ cat /etc/observatory admin_panels = imaginary spider = taking_notes cat = supervising $ echo "please stop calling" incoming SIP INVITE… ▌