Methodology

TroyanosYVirus uses a network of **honeypots** (decoy systems) strategically distributed across 5 continents to attract, detect and analyze cyber attacks in real time. A honeypot is a computer system configured to appear as a legitimate and attractive target for attackers. When an attacker interacts with the honeypot, all their actions are logged and analyzed, providing valuable intelligence about: - **Attack vectors** currently in use - **Malicious IPs** and their geolocation - **Credentials** tested in brute force attacks - **Malware** deployed by attackers - **Commands** executed after gaining access

We implement multiple controls to ensure data quality: - **Deduplication**: We remove duplicate events from the same attack - **IP validation**: We verify that IPs are public and valid - **Noise filtering**: We exclude known benign scans (Shodan, Censys, etc.) - **Malware verification**: Hashes are checked against VirusTotal - **Continuous updates**: Data is updated every minute

It's important to understand honeypot data limitations: - **Geographic bias**: Honeypot location affects which attacks are captured - **Targeted attacks**: Very sophisticated attacks may detect honeypots - **Volume vs. impact**: High attack volume doesn't always mean greater danger - **Attribution**: IPs may be proxies, VPNs or compromised machines - **False positives**: Some legitimate scans may be classified as attacks

We follow ethical principles in our research: - **No offensive interaction**: Our systems are passive, we never attack back - **Public data**: We only publish IPs that performed verifiable malicious activity - **Privacy**: We don't collect personal data from legitimate users - **Responsibility**: Data is provided "as is" without warranties - **Legitimate use**: Data is intended for research and defense, not retaliation