Decoy map

Where the decoys are being visited from. Countries are worked out from the shortened network we already keep, so they are approximate, and no address is stored. Small groups are hidden and the figures run a day behind real time.

IP Geolocation by DB-IP. Public attack data from Cloudflare Radar. Unless an admin has switched on Live, pulses are drawn in proportion to the real counts; they are not a live feed of individual requests.