From dots on a globe to hacker networks: grouping attackers by behavior
How our honeypot globe learned to tell “a thousand IPs” from “a handful of crews”
For months our attack globe showed one dot per banned IP. It looked great and told us very little. Look at the WordPress noise, the .env hunters, the people scraping for .aws/credentials: they are not thousands of individuals. They are a few crews rotating through cloud servers.
So we taught the globe to group them.
What a “network” is
A network is a set of addresses that behave alike. We compare, per address:
- the paths they ask for (a set of at least two, so one shared
/wp-login.phpproves nothing) - the provider or autonomous system
- the user agent
- when they arrived: networks are born only from addresses seen in the same wave of about two days, but a later address can still join one that fits
A network needs at least three addresses to exist. If an address fits two networks equally well, it joins neither. The rule we cared about most: it is better to split a real crew in two than to merge strangers into one.
Names and roles
Every network gets a permanent name: colour + trait + tool, for example “Amber Brazen Seine” or “Coral Sleepless Net”. The trait comes from facts, never at random: “sleepless” means most of its traffic arrives at night, “sly” means a large share hides behind proxies, “hasty” means a stolen key was used within minutes. The tool depends on the role:
- Collectors steal keys and configs (
/.env,/.aws/credentials,/.git/config). Their tools catch things: nets, seines, hooks. - Executors use what was stolen. Their tools burn: fireballs, sparks, comets.
- Stormers hammer WordPress and SSH. Their tools hit: rams, crowbars, sledgehammers.
Names never change on their own. Known internet scanners such as LeakIX, Shadowserver and Censys are recognised and shown in white under their real names.
The dossier
Click a network and a brief opens on the side, then a full dossier: countries, providers and network types, active hours, new nodes per day, top paths, AWS calls, and a journal. If the behaviour matches a known campaign it says so, for example “looks like AndroxGh0st” (a .env scraper that then calls SES) or "looks like LLMjacking" (a hunt for access to Bedrock models). These are hints from behavior, not attribution.
Bait keys that tell a story
Our honeypots serve fake credential files. Each scanner gets its own bait AWS key, issued per address. When a key is used later, from any address, the globe knows which scanner received it. That turns a pile of events into a chain: this address took the key, that one used it two days later and called ListFoundationModels.
Get Stanislav Obrazcoff’s stories in your inbox
Join Medium for free to get updates from this writer.
In the last month the bait keys were used more than a thousand times. One network alone left 100+ such links in its journal, and its dossier shows exactly which address handed a key to which.
We do not merge networks because of a key. Keys get sold and shared, so a key is a link, not an identity. The address that used it is attached to the network that took it, and the two networks stay separate.
Kin, not merges
Some crews look alike without being provably the same. We show them as kin: networks with at least four rare shared paths plus another sign (same provider, same user agent, similar hours). The dossier spells out the reasons, and ends with a reminder: a hint, not a fact; networks are never merged.
What we got wrong on the way
- Counting bans as hours: our first “night share” mixed bans and requests and could exceed 100%, which would have given networks a false “sleepless” trait. Names are permanent, so we fixed it before freezing.
- Common paths are not evidence:
/.envand/.git/configare requested by everyone. Kin only counts paths that are rare among networks of the same role. - A restarted service must not make history vanish: the first fill reads every rotated log with the service stopped, and each log has its own read cursor, so a re-read tail never counts a request twice.
Under the hood
Plain Python standard library on the server, a SQLite book of nodes that is kept forever (attacks themselves live 30 days), and plain three.js in the browser, no build step. The layer adds no animation of its own: stars and rays are drawn once and only move with the camera.
Hacker networks run on two small honeypot servers, so treat the numbers as a field notebook, not a threat feed. But the idea scales: describe attackers by what they do, and the noise turns into a handful of characters you can name.
