Bold Earwig live
Sydney · SYD1
Apache Tomcat 8.0.45
CVE-2017-12617 JSP upload → webshell
// live project · greynoise project swarm
Four sensors.
One month of internet noise.
Four GreyNoise Project Swarm sensors, each in a different region and running a different vulnerable profile, keeping full PCAP of everything that hits them. No lab environment and no answer key, just real scanners, botnets and exploit traffic taken from first packet to payload.
Inspired by John Hammond's interview with the creator of GreyNoise.
4
sensors
4
regions
2
writeups published
0
outbound allowed
fleet live since 2026-10-14 · running for one month
// the fleet
Pensive Markhor live
Singapore · SGP1
Cowrie Telnet Honeypot
Telnet logins + shell sessions (IoT botnets)
Vibrant Quetzal live
San Francisco · SFO3
React Server Components
CVE-2025-55182
writeup in progress
Festive Goat live
Frankfurt · FRA1
WordPress MasterStudy LMS
Plugin LFI / traversal (2024 CVE cluster)
writeup in progress
// investigations
Wrong Door
A honeypot that announces itself as Apache Tomcat 8.0.45 spends a day being hit with Apache httpd, PHP-CGI, PHPUnit and Next.js exploits, delivering RedTail and a Mirai-family dropper, and not one attacker tries the Tomcat bug it was built to catch.
captured 2026-10-15 8 ATT&CK techniques
Mozi Zombie Loader
Honeypot investigation tracing a Mozi IoT bot from a Mirai-fingerprinted SYN scan through a ZTE default-credential telnet login and busybox loader to a 2021-era payload still being served by infected peers in 2026.
captured 2026-10-14 14 ATT&CK techniques
// how it works
01
Deploy. Each sensor is a small DigitalOcean droplet registered with GreyNoise and given one profile, so each one draws a different slice of traffic: IoT telnet botnets, Tomcat upload exploits, React Server Components RCE, WordPress plugin traversal.
02
Contain. Outbound traffic is disabled. Attackers can log in and run commands, but nothing they download ever arrives, so the sensors never join a botnet. The cost is losing stage 2, which threat intel pivots usually recover.
03
Capture. GreyNoise keeps about 24 hours of PCAP per sensor, so interesting sessions are exported the same day and taken apart in Wireshark and tshark.
04
Investigate. Each writeup follows one actor from first packet to payload: fingerprinting the scanner, reconstructing the session, pivoting through URLhaus, MalwareBazaar and AbuseIPDB, and taking any recovered sample apart in an isolated REMnux VM.
05
Publish safely. Sensor IPs never appear, attacker IOCs are defanged, and each writeup goes live only after its sensor has been torn down.