The machine
One low-cost VPS rented from cloudserver.net. It hosts nothing other than this service. There is no website on it other than the text you're reading, no database, no mail, no other applications of any kind. Every TCP port on the machine is wired to a single listener that accepts the connection, sends back exactly zero bytes, counts whatever the other side says, and hangs up. It never replies to anything.
Traffic turns up regardless. That's just how it is for a server on the rough seas of the internet. Within sixty seconds of the machine coming online, something in Australia tried its SMB port. This is internet background radiation: automated scanning that sweeps the entire IPv4 address space looking for anything that answers.
None of it was aimed specifically at this server. Nobody picked this machine. It just has an address, and that is enough. Every one of those connections drops a shape onto the grid above, which runs Conway's Game of Life at six generations per second. Nothing else feeds it. What you are watching is near-real-time scan traffic.
How a connection becomes a shape
- Where it lands
- The source address, cut to its first 16 bits and mapped through a Hilbert curve. One cell per /16 network. The same network always disturbs the same patch of grid, so regular visitors wear a groove.
- What colour it is
- The port they knocked on. Slate for shells, steel blue for web, teal for file sharing, violet for remote desktop, magenta for VNC, amber for mail, orange for databases. Red for anything unrecognised, which is most of the 65,535 of them and most of the traffic.
- What shape it makes
- Almost everything leaves inert debris. Consequence has to be bought by being genuinely unprecedented: the first time a network has ever reached this machine sends a glider across the world to colonise somewhere else, and the first time anyone has ever knocked on a particular port drops an R-pentomino, which burns for roughly 1,100 generations before it settles. As the machine learns the shape of the internet, both get rarer, and the world calms with age.
- What stops it filling up
- Above 8% of the grid alive, the oldest cells are culled until it drops back under. No decay constant to tune, and it holds whether the machine gets a hundred connections a day or a million.
This is not an attack map
It would be easy to dress this up as a wall of incoming attacks being heroically repelled. That would be a lie. Almost none of this traffic is an attack on anything, and none of it is an attack on this machine specifically. It is untargeted sweeping, the same sweeping that hits every address on the internet continuously, forever.
The Honeynet Project's HoneyMap got read by the press as a picture of which countries were winning a cyberwar. It was not that, and there is a country table further down this page that carries exactly the same risk, so it is worth being blunt about what it means. A country code here is where an address block was registered. It is frequently not where the machine is. It is never where the person is. A great deal of scanning runs on rented capacity in whichever jurisdiction was cheapest that week, which means the table below is a map of the hosting industry and its billing addresses, and nothing more than that.
The honest reading is duller and more interesting. Something very small is being weathered by something very large, the way a rock is weathered. An ecosystem, not a battlefield.
Questions
Is this a honeypot?
Not really. A honeypot pretends to be a service so it can record what an attacker does next. This does the opposite: it never speaks, so there is nothing to fool anyone and nothing to interact with. It records that a connection happened, which port it wanted, how many bytes arrived, and which network it came from. The bytes themselves are counted and thrown away without ever being examined.
Are you storing what people send?
No. The payload is read into a fixed buffer, the length is recorded, and the buffer is returned to a pool unexamined. Nothing an unknown party sends is ever stored, displayed, logged, or parsed. Source addresses are masked to their first 16 bits before anything is written to disk, so the individual host is discarded too. The handler is not even given a socket it could write back to.
Why is my network on here?
Because something using one of its addresses connected to this machine. Networks listed in the census are usually hosting providers renting capacity to whoever pays, which is where most scanning originates. A network is not a person and not a country. It is an allocation.
Why is my country near the top?
Because a lot of address space is registered there, and because cheap hosting concentrates. The United States and a handful of European countries sit high on that list mostly because that is where the large providers register their blocks. It says nothing about anybody who lives there, and the original design of this site left country data out entirely for that reason. It is shown now with the caveat attached rather than hidden.
Does the grid ever reset?
Not so far. It has been running unbroken since the machine was built. If it goes down, the world resumes from where it stopped rather than skipping ahead, and the downtime leaves a scar at the machine's own coordinate.
The server reboots from time to time for patching, but the design preserves state across restarts.
Is the animation real, or a loop?
Real. The server runs the simulation and streams you only the arrivals as they happen. Your browser runs the identical simulation locally and draws it. Two people watching at the same time see the same world.
Colophon
One static Go binary, about seven thousand lines. No containers, no database, no external services at runtime. nftables hands the machine's TCP ports to a single unprivileged socket. Network names come from IPtoASN, refreshed weekly. Arrivals are appended to a fixed-width log at 22 bytes each, which works out at about 400MB a year, sealed and hashed nightly.