Downloads

The aggregated CSVs are kilobytes and anyone can grab them; the raw data is orders of magnitude larger. Files that have not been generated yet are marked.

Aggregates

Exactly the numbers behind the charts and tables in the results, plus the log of commands run on the servers.

Individual events

Every sensor event as an individual record, in compressed JSONL – for your own analysis.

Session recordings

Recordings of interactive sessions. They are small and among the most interesting artefacts of the whole run.

Malware samples

Malware captured by the honeypots, in a password-protected archive.

Pick one of the published CSV files, a column for the X axis and a value for the Y axis, and narrow the rows with WHERE conditions if you like. The chart is computed on the server straight from these files – no other file or column than the ones listed here can be read.

SUM(events) by date

52 of 52 rows match the conditions; the X axis has 26 distinct values.

The first and last day of the window are half days – the window opens and closes at 12:00 UTC.

Source data

honeypot-timeline-20260922.csv

Time window

2026-08-22 12:00:00 UTC – 2026-09-16 12:00:00 UTC

Script

hp_aggregate.py · d60ff11

Format

field documentation

Equivalent SQL

SELECT date, SUM(events) FROM timeline.csv GROUP BY date ORDER BY date

For every published file: field name, type, meaning and an example. The examples illustrate the format; they are not values from the data.

ports.csv

One row per combination of port, protocol and server.

timeline.csv

One row per day and server.

geo.csv

One row per combination of country and autonomous system.

credentials.csv

One row per username and password combination.

attacker_commands.csv

One row per unique command.

samples.csv

One row per unique sample by SHA-256.

commands.csv

Log of the commands agents and the operator ran on the servers. One row per command; command outputs are not included.

Agent chats and journals

Each session comes in two forms: Markdown (the agent’s readable text, reasoning summaries, commands and outputs) and a raw JSON export for machine processing. Both are in the original language. If an English translation of a session exists, it is a separate file and always labelled as a translation on the site.

Individual events

The raw event format differs by sensor and by server. Field documentation will be added when the data is published.

The data and the scripts each have their own licence. You may use them at work or in research – just credit the source.

Data

CC BY-NC 4.0

Scripts

to be added

Script repository

to be published

If you use the data, please credit the source. One line is enough:

Barták, Tomáš (2026). Honeypot dataset: 25 days of traffic from two honeypots, 22 Aug – 16 Sep 2026 [Data set]. https://batacek.eu/honeypot/

BibTeX

@misc{bartak2026honeypot,
  author = {Barták, Tomáš},
  title  = {Honeypot dataset: 25 days of traffic from two honeypots, 22 Aug – 16 Sep 2026},
  year   = {2026},
  url    = {https://batacek.eu/honeypot/},
  note   = {Data set}
}