What this is
One rented server in Chicago. It hosts nothing. There is no website on it, no database, no mail, and SSH has been moved off its usual port. Every TCP port on the machine is wired to a single listener that accepts the connection, sends back exactly zero bytes, counts whatever the other side says, and hangs up. It has never replied to anything.
Traffic turns up regardless. Within sixty seconds of the machine coming online, something in Australia tried its SMB port. This is internet background radiation: automated scanning that sweeps the entire IPv4 address space looking for anything that answers. None of it was aimed here. Nobody picked this machine. It just has an address, and that is enough.
Every one of those connections drops a shape onto the grid above, which runs Conway's Game of Life at six generations per second. Nothing else feeds it. What you are watching is scan traffic and nothing but scan traffic.
How a connection becomes a shape
- Where it lands
- The source address, cut to its first 16 bits and mapped through a Hilbert curve. One cell per /16 network. The same network always disturbs the same patch of grid, so regular visitors wear a groove.
- What colour it is
- The port they knocked on. Slate for SSH and Telnet, steel blue for web ports, teal for Windows file sharing, violet and magenta for remote desktop, amber for mail, orange for databases. Red for anything that does not fit, which is most of the 65,535 of them.
- What shape it makes
- Busy ports get inert debris. Rare ports get an R-pentomino, which burns for roughly 1,100 generations before it settles. First contact from a network that has never touched this machine before gets a glider, which crosses the world and colonises somewhere else.
- What stops it filling up
- Above 8% of the grid alive, the oldest cells are culled until it drops back under. No decay constant to tune, and it holds whether the machine gets a hundred connections a day or a million.
This is not an attack map
It would be easy to dress this up as a wall of incoming attacks being heroically repelled. That would be a lie. Almost none of this traffic is an attack on anything, and none of it is an attack on this machine specifically. It is untargeted sweeping, the same sweeping that hits every address on the internet continuously, forever.
The Honeynet Project's HoneyMap got read by the press as a picture of which countries were winning a cyberwar. It was not that, and there is a country table further down this page that carries exactly the same risk, so it is worth being blunt about what it means. A country code here is where an address block was registered. It is frequently not where the machine is. It is never where the person is. A great deal of scanning runs on rented capacity in whichever jurisdiction was cheapest that week, which means the table below is a map of the hosting industry and its billing addresses, and nothing more than that.
The honest reading is duller and more interesting. Something very small is being weathered by something very large, the way a rock is weathered. An ecosystem, not a battlefield.
Questions
Is this a honeypot?
Not really. A honeypot pretends to be a service so it can record what an attacker does next. This does the opposite: it never speaks, so there is nothing to fool anyone and nothing to interact with. It records that a connection happened, which port it wanted, how many bytes arrived, and which network it came from. The bytes themselves are counted and thrown away without ever being examined.
Are you storing what people send?
No. The payload is read into a fixed buffer, the length is recorded, and the buffer is returned to a pool unexamined. Nothing an unknown party sends is ever stored, displayed, logged, or parsed. Source addresses are masked to their first 16 bits before anything is written to disk, so the individual host is discarded too. The handler is not even given a socket it could write back to.
Why is my network on here?
Because something using one of its addresses connected to this machine. Networks listed in the census are usually hosting providers renting capacity to whoever pays, which is where most scanning originates. A network is not a person and not a country. It is an allocation.
Why is my country near the top?
Because a lot of address space is registered there, and because cheap hosting concentrates. The United States and a handful of European countries sit high on that list mostly because that is where the large providers register their blocks. It says nothing about anybody who lives there, and the original design of this site left country data out entirely for that reason. It is shown now with the caveat attached rather than hidden.
Does the grid ever reset?
Not so far. It has been running unbroken since the machine was built. If it goes down, the world resumes from where it stopped rather than skipping ahead, and the downtime leaves a scar at the machine's own coordinate.
Is the animation real, or a loop?
Real. The server runs the simulation and streams you only the arrivals as they happen. Your browser runs the identical simulation locally and draws it. Two people watching at the same time see the same world.
Colophon
One static Go binary, about seven thousand lines. No containers, no database, no external services at runtime. nftables hands all 65,535 TCP ports to one unprivileged socket. Network names come from IPtoASN, refreshed weekly. Arrivals are appended to a fixed-width log at 22 bytes each, which works out at about 400MB a year, sealed and hashed nightly.