Denmark Threat Pulse.
A focused view of the signals observed through our honeypot research. Updated from our cached feed, with coverage and freshness shown openly.
These are XXC-Defence observations, not a nationwide threat level. Indicator counts are not attack counts. A source IP does not identify a person or establish attribution.
Snapshot updated: 2026-10-26 22:30:03 UTC
Showing the latest available snapshot. Updates are currently delayed.
Latest observations: 50 / 50
Trend collection starts with the next fresh, successful feed import. The latest 50 cached IoCs remain available below.
Investigate ↗How the snapshot changes
Each point is the number of distinct indicators seen within the preceding 24 hours in that feed snapshot. Overlapping snapshots are never added together. Gaps mean no fresh successful import.
Trend collection starts with the next fresh, successful feed import. The latest 50 cached IoCs remain available below.
Feed categories
Latest observations · 50 / 50
Indicator types
Latest observations · 50 / 50
Technology context
The current feed does not provide enough technology context to identify targeted products. We do not infer a target from an IP or domain.
What this means
Use these observations as a starting point for investigation. Changes can reflect activity, feed coverage or filtering. Compare them with your own logs before deciding on a response.