vnc14,06861 sources / 40.5% of published app labels
Public threat intelligence
Mothlight maps public honeypot probes to techniques, targeted stacks, CVEs, and post-compromise behavior.
Daily counts cover delayed observations classified as exploit activity or carrying attack, technique, or CVE tags.
| Date | Attacks |
|---|---|
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
Dots at the baseline mark suppressed daily cells. A true zero remains visible as zero.
The mapping describes the observable action against a public application. It does not claim campaign or actor attribution.
| Technique | ATT&CK | Attacks | Sources |
|---|---|---|---|
| Service Discovery | T1046 | 19,471 | 1,540 |
| Brute Force | T1110 | 15,886 | 229 |
| Info Leak | T1552.001 | 283 | 13 |
| Cred Access | T1552.001 | 20 |
Application labels identify the stack an inbound probe expected to find. Severity reflects exploit impact, not confirmed compromise.
vncrdptelnetsshsmbpostgresmongodbelasticsearchCounts show matching probes, never proof that a vulnerable product was present or exploitation succeeded.
| CVE | Targeted app | Attempts | Sources | First seen | Last seen |
|---|---|---|---|---|---|
CVE-2021-41773 | unknown | 5 | 5 | ||
CVE-2021-42013 | unknown | 5 | 5 | ||
CVE-2024-23897 | dotenv | 3 | 2 |
Discovery is common. Replaying a planted secret or following a canary is rarer and higher-value evidence of a second stage.
1,679 distinct sources.
14 distinct sources.
No qualifying observation yet. 301 decoys planted.
No qualifying observation yet. 191 decoys planted.
Zero is a valid early result. Mothlight currently shows 0 replay signals and 0 canary follows after the publication delay.
First-seen labels use the retained observation history. Persona rows show the leading published technique for each fictional decoy surface.
reconrceCVE-2021-41773CVE-2021-42013cred-accessCVE-2024-23897info-leakbrute-forceinfo-leak280 observations / 12 sourcesinfo-leak3 observations / 3 sourcesAI-agent is an inferred cohort based on classification and AI-likelihood evidence. It is not a claim about a specific model or vendor.
1,679 sources. Leading technique: service-discovery (19,471 observations).
Only repeated, delayed summaries are shown. Mothlight does not publish payload bodies, prompts, exploit commands, or attacker-supplied URLs.
No repeated payload summary meets the publication threshold.
| 0 |
| 0 |
| 0 |
| 0 |
| 0 |
| 0 |
| 0 |
| 0 |
| 0 |
| 148 |
| 35,563 |
| 5 |
| Rce | T1190 | 8 | 3 |
| Recon | T1595 | 3 | 2 |
| Observed technique | MITRE ATT&CK | Share |
|---|---|---|
| Service DiscoveryLast seen Nov 1, 2026 | T1046Network Service Discovery | 54.6% |
| Brute ForceLast seen Nov 1, 2026 | T1110Brute Force | 44.5% |
| Info LeakLast seen Nov 1, 2026 | T1552.001Credentials In Files | 0.8% |
| Cred AccessLast seen Nov 1, 2026 | T1552.001Credentials In Files | 0.1% |
| RceLast seen Nov 1, 2026 | T1190Exploit Public-Facing Application | 0.0% |
| ReconLast seen Nov 1, 2026 | T1595Active Scanning | 0.0% |
| critical | 8 | 0.0% |