Where Bot Traffic Comes From: What One Honeypot Network Saw

Home › Guides › Where Bot Traffic Comes From

✓ data: two open honeypot datasets published by CSIRT-UPJS (Pavol Jozef Šafárik University in Košice), CC BY 4.0, downloaded 2 October 2026 · method · caveats · download the data

Which countries does automated attack traffic come from? Honeypots are decoy servers that exist only to be attacked, so almost everything that reaches them is bots: scanners, password-guessers and malware spreading itself. We analysed two openly licensed datasets from one university security team’s honeypots. Between them they cover 26.5 million recorded attacks across 329 days, from November 2024 to December 2025.

Read this first. This is what one honeypot network saw, not a global ranking. The published files name only the top 10 source countries in each period. A handful of IP addresses can move a country up or down, and a country is where an IP address is registered, not where the person controlling it is. We did not use our own site’s traffic: Cloudflare has only just started logging it, so there is less than a day of data, and much of it is our own tools.

attacks recorded 26.5 milliontop source, Jul–Dec 2025 United States, 13.1%top source, Nov 2024–Apr 2025 Taiwan, 23.7%countries in both top 10s 7

Headline numbers

1. Tens of thousands of attacks a day. The honeypots logged 14,768,895 attacks from 4 Nov 2024 to 3 Apr 2025 (97,807 a day) and 11,739,398 from 7 Jul 2025 to 31 Dec 2025 (65,952 a day).
2. The top 10 countries account for about two-thirds of attacks. The ten named countries sent 67.1% of all attacks in the first period and 63.7% in the second. The datasets don’t break down the rest.
3. The United States moved to the top. US addresses sent 13.1% of all attacks in July–December 2025, more than any other country, up from 7.9% (fourth place) in November 2024–April 2025. They were also among the steadiest: US attacks were recorded on all 178 days, and the five busiest days made up only 5.6% of the total.
4. Rankings change a lot from one period to the next. Taiwan was the biggest source in the first period (23.7% of all attacks) and wasn’t in the top 10 in the second. The Netherlands wasn’t in the first top 10 and came second in the later one (11.2%). 7 countries made both lists: China, France, Germany, India, Indonesia, Russia and the United States.
5. Some countries’ totals come from a few bursts. 85.1% of attacks from French addresses in the second period arrived on just five days. The busiest, 29 Nov 2025, brought 338,079. Germany (58.6% in the first period) and Vietnam (45.9% in the second) show the same pattern. Taiwan’s first-period lead was steadier: its five busiest days made up 12.0% of its total.
6. A small number of sources does most of the work. In a typical half hour the honeypots saw a median of 38 distinct IP addresses in the first period and 36 in the second, generating a median of 1,549.5 and 898.5 attacks. That is dozens of attacks per address.
7. Most attacks target remote logins. The SSH/Telnet honeypot (Cowrie) took 74.8% of attacks in the first period and 63.8% in the second. Dionaea, which imitates file-sharing, database and other services that malware targets, took 15.1% and 21.8%.

Share of attacks by source country

November 2024 – April 2025

July – December 2025

Month by month

Steady sources and bursts

Method

• Source. “Attacks on Honeypots (October 2024 – April 2025)” (DOI 10.17632/j9zm8nj76j.1) and “Attacks on Honeypots (June 2025 – January 2026)” (DOI 10.17632/y2vvn22zkx.1), published on Mendeley Data by Vanda Matušíková (CSIRT-UPJS, Pavol Jozef Šafárik University in Košice) and licensed CC BY 4.0. We downloaded all eight CSV files on 2 October 2026 and checked each one against the SHA-256 hash Mendeley publishes.
• Coverage. Despite their titles, the files run from 4 Nov 2024 to 3 Apr 2025 and from 7 Jul 2025 to 31 Dec 2025 (UTC), in half-hour intervals. The second dataset has 3 gaps longer than six hours, the longest in mid-July 2025.
• Totals. “Attacks” is the dataset’s own count of attack events, summed over every half hour. Country totals come from the source-country file. Shares are a country’s attacks divided by all attacks in the overall attack-count file for the same period.
• Bursts. For each country and period we added up attacks per UTC day and took the share that fell on its five busiest days.
• Not used. The port files measure something different from the attack counts (their totals don’t match), so we leave them out. We checked other sources first. AbuseIPDB’s and GreyNoise’s terms don’t allow republishing their data on a commercial site. SANS ISC/DShield licenses its API data CC BY-NC-SA 4.0 (non-commercial), and its feeds page states different terms, so we would need written permission to use it here. We didn’t use Cloudflare Radar.
• Verification. A separate script re-reads the raw CSV files and recomputes every number on this page and in our CSVs.

Caveats

• One network’s view. The datasets come from one team’s honeypots and don’t say how many sensors there were or where they were hosted. Bots don’t scan everywhere evenly, so another network would see a different mix.
• Top 10 only. About a third of attacks in each period come from countries the files don’t name. A country missing from a list may simply have been 11th.
• A country is where an address is registered, not who controls it. Attackers rent cloud servers, use hijacked devices and route through proxies, so an attack from a country’s address space says little about who is behind it. Countries with big hosting industries, such as the US, the Netherlands, Germany and Singapore, may rank high partly for that reason. The dataset doesn’t say how locations were assigned.
• A few addresses can dominate. With a few dozen distinct IP addresses in a typical half hour, one busy address can move a country’s rank. That is why we show the burst measure.
• Honeypot attacks aren’t website traffic. These are mostly login attempts and exploit probes against network services, not scrapers or crawlers visiting websites. They show where automated attack traffic comes from, not where web-scraping traffic comes from.
• Dated. The newest data ends on 31 December 2025.

Download the data

• By country and period (CSV): attacks, share of all attacks, share of the top 10, days with attacks, share on the five busiest days and the busiest day, for each top-10 country.
• Monthly (CSV): attacks by source country and UTC month.

Cite as: ProxyPicker, “Where Bot Traffic Comes From: What One Honeypot Network Saw”, 2 October 2026, https://proxypicker.com/where-bot-traffic-comes-from/. Data: Matušíková, V., “Attacks on Honeypots (October 2024 – April 2025)”, Mendeley Data, V1, doi:10.17632/j9zm8nj76j.1, and “Attacks on Honeypots (June 2025 – January 2026)”, Mendeley Data, V1, doi:10.17632/y2vvn22zkx.1, both licensed CC BY 4.0. We aggregated the data (country, daily and monthly totals); the original files are unchanged on Mendeley.

Related: Residential IP Supply by Country · Residential proxy botnet timeline · Anti-Bot Census · AI Crawler Census · What’s my IP? Proxy & VPN checker.

Press & data requests: email [email protected] for interviews, the raw data behind this page, or corrections. See also our contact page.