XXC/DEFENCE
We operate several Danish websites as honeypots to study the attacks and attack vectors that may target Danish infrastructure. Real observations help us ask better questions about the threats around us.
Explore the latest observationsHoneypots give us a place to observe unsolicited scans, exploitation attempts, and other malicious activity. They help us understand which services are being probed, which techniques are being used, and how patterns change over time.
We collect indicators of compromise (IoCs) and the context around them. Depending on the activity, these may include IP addresses, domains, URLs, file hashes, and request patterns. An indicator is a starting point for investigation, not proof of who is behind an attack.
By studying activity against Danish web environments, we can better understand what may affect Danish infrastructure. We use those observations to inform our threat research, improve security tools, and contribute to stronger defences whenever we can.