Prompt probes, autonomous browsing, tool misuse, and agent-like traffic patterns.
LIVE
TrapLayer Observatory
Threat intelligence from attackers who take the bait.
TrapLayer turns controlled deception infrastructure into public-safe research, paid IOC feeds, SIEM-ready telemetry, and AI-agent attack intelligence.
Live collection
Public-safe aggregate view
Metadata, `.env`, Terraform, kubeconfig, and CI secret hunting without real secrets.
Git, CI/CD, container registry, Kubernetes, and package registry reconnaissance.
SSH and SCADA/OT facades that reveal attacker intent while staying isolated.
AI Attack Intelligence
Agent Behavior Signals
No reportable AI-agent events are available in this window.
AI events0
Prompt attacks0
Tool abuse0
RAG/memory probes0
Tactics
Observed AI Patterns
No AI-agent attack signals yet0
Public vs Private
What This Observatory Shows
Public pages show enough signal to prove coverage and trends. Raw evidence, canaries, headers, payloads, and customer controls stay private.
Counts, severity, category, coarse geography, and sanitized event summaries.
JSON, STIX-style JSON, and SIEM CEF outputs with confidence and taxonomy fields.
Payloads, request traits, canary lineage, collector details, and operational notes.
Energy, SaaS, fintech, healthcare, legal, security, and DevOps-focused lure networks.
Why TrapLayer Wins
Threat intelligence built from live attacker behavior, not stale lists.
TrapLayer combines public observability with private customer telemetry from realistic lure companies, cloud traps, protocol collectors, canaries, and AI-agent bait.
Behavior-first deception intelligence
Purpose-built lures reveal what attackers try to do, which tools they use, what credentials they hunt, and which industry stacks they target.
- AI-agent, cloud, DevOps, email, SSH, SCADA, and database collectors
- Customer-specific dashboards, API keys, JSON feeds, and SIEM payloads
- Public-safe observatory plus private raw evidence controls
- Campaign-driven lure companies mapped to real-world industry profiles
Static indicators and delayed context
Most feeds center on IPs, hashes, domains, or retroactive enrichment. Useful, but often thin on attacker intent.
- Fast to ingest, but easy for attackers to rotate around
- Limited visibility into hands-on behavior and payload goals
- Usually detached from customer-specific lure campaigns
Signals without productized delivery
Standalone traps can catch noise, but often lack tenant controls, analyst workflows, billing, SIEM formats, and public proof.
- Harder to package for SOC teams and customers
- Often focused on one protocol instead of full attack journeys
- Less emphasis on clean reporting and human-readable value
| Capability | TrapLayer | Traditional feeds | Generic honeypots |
|---|---|---|---|
| Live attacker intent | Native | Limited | Partial |
| AI-agent lure coverage | Built in | Rare | Rare |
| Industry-specific campaigns | Energy, SaaS, fintech, healthcare, DevOps | Broad tags | Manual setup |
| Customer-ready feeds | JSON, SIEM, dashboards | Usually yes | Usually no |
| Public proof layer | Live observatory and reports | Marketing claims | Uncommon |
14-Day Activity
2026-06-27
0
2026-06-28
0
2026-06-29
0
2026-06-30
0
2026-07-01
0
2026-07-02
0
2026-07-03
0
2026-07-04
0
2026-07-05
0
2026-07-06
0
2026-07-07
0
2026-07-08
0
2026-07-09
0
2026-07-10
498
Threat Categories
scanner
494
benign
4
Severity
high
212
medium
282
info
4
Top Classifications
unknown_suspicious282
exploit_scanner212
benign_unknown4
Top Lures
| /favicon.ico | 16 |
| /.env | 10 |
| /.env.production | 8 |
| /.env.local | 7 |
| /wp-admin/install.php | 7 |
| /config.json | 6 |
| /.env.bak | 5 |
| /.git/config | 5 |
Client Types
browser394
unknown69
tool35
Sanitized Evidence
Recent Anonymized Events
| Time | Type | Path | Category | Class | Severity | Risk | Summary |
|---|---|---|---|---|---|---|---|
| 2026-07-10 06:03:53 | scanner_probe | /wp-admin/install.php | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:54:49 | scanner_probe | /wp-admin/install.php | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:44:51 | scanner_probe | /wp-admin/install.php | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:24:50 | scanner_probe | /wp-admin/install.php | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /.aws/credentials | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /backend/.env | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /.env.local | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /config.env | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /api/.env | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /.env.production | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /.env.bak | scanner | exploit_scanner | high | 80 | Open |
| 2026-07-10 05:14:19 | scanner_probe | /app/.env | scanner | exploit_scanner | high | 80 | Open |