Real-world attacker activity

Live attacker IPs from SANS Internet Storm Center (DShield) honeypot telemetry, geo-located in real time. Pulse and beam animations track active scanners, brute-forcers, and botnet operators worldwide. No simulation — this is what is happening right now.