Ukraine Sensor — Final Statistics

This passive honeypot sensor in Ukraine has been decommissioned. The live feed is gone; the figures below are a frozen snapshot generated 2026-10-12 13:42 UTC from everything it recorded. Collection ran from 2026-08-30 20:19:01 to 2026-10-02 21:10:14 UTC.

Totals

Patterns observed

• Ramp, peak, then plateau. Daily volume climbed from about 600 interactions on day one to a peak of 615,277 on 2026-09-10. It eased to 173K–268K per day over 09-12 to 09-15, then held at 101K–138K per day from 09-16 to 09-22, with roughly 900–1,000 distinct sources per day.
• VNC dominated. Port 5900 (VNC) accounted for about 86% of all interactions (3.85M), from 777 sources. SSH was second (357K, 3,814 sources), then MySQL (198K) and Telnet (31K).
• No day/night cycle. Hourly volume stayed within about 165K–202K per hour bucket across all 24 UTC hours. That flatness points to automated, always-on scanning rather than operators working a schedule.
• Hosting providers did most of the work. DigitalOcean, Contabo and Dynu together produced roughly two-thirds of all interactions. The top single source (AS213790) is a UK-registered network whose addresses geolocate to Germany.
• Coordinated bursts. Four Dynu-hosted addresses (AS398019) each logged about 57K–59K hits, all with last-seen times within the same three seconds on 2026-09-11, which is consistent with one scanning campaign spread across several addresses.
• Persistent sources. Several addresses were still active on the last day of data (2026-10-02), including the single most active source, so the scanning was ongoing rather than a one-off surge.
• Scanning is geographically broad. The United States, Germany and China were the top source countries by hits, but traffic came from 145 countries.
• TCP fingerprints. About half of the fingerprinted SYN packets matched Linux 2.2.x–3.x stacks and about 13% matched Windows 7/8. About 29% matched no known signature.
• Common targets beyond the emulated services. Dropped connection attempts clustered on port 2222 (alternate SSH), 3389 (RDP), 8443, 8000, 554 (RTSP), 53 (DNS) and 25 (SMTP).

Timeline

Outage: September 2026

Daily interactions

Bars are interactions per day (UTC). Gaps are periods the sensor was offline or not reporting. Dates are the attacker-side timestamps.

Hour of day (UTC)

Interactions by emulated protocol

Most-targeted ports (emulated services)

Dropped connection attempts (unemulated ports)

Connection attempts the firewall logged and dropped on ports the sensor doesn't emulate. "egress" rows are traffic leaving the sensor, not attacker traffic.

Source countries

Source networks (ASNs)

Top source IPs

Passive TCP/IP fingerprints (p0f)

OS/stack guesses from each inbound SYN's header shape alone. Counts are per packet; "unrecognized" means p0f had no matching signature.

Data notes

• Interaction timestamps are the attacker-side times recorded by the sensor. Most of the 09-13 to 09-23 counts were ingested in one batch on 09-30, after log shipping was repaired.
• No records exist for 09-24 through 09-29 (sensor offline) or after 10-02 21:10 UTC.
• IOC matching compares sources against an abuse.ch ThreatFox IP list. No sources matched in this snapshot.
• This page is static. Figures were frozen at generation time and will not update.