cyberzone.hu
WHAT THIS SITE IS
cyberzone.hu is a deliberately empty "parked" domain. It measures how much gets thrown at an empty server that no human ever finds on purpose. The stats tab shows the numbers; this page explains exactly what's running underneath.
BAITS AND TRAPS
- SSH · 22
- fake SSH server (the real one lives elsewhere): never lets anyone in, just drip-feeds random lines back for as long as the connection stays open.
- PHP2Shell
- recognises and logs uploads shaped for an October 2026 PHP vulnerability; there is no PHP here.
- phpinfo
- a fake phpinfo() page showing a deliberately vulnerable-looking PHP version, baiting the trap above.
- .env / .git
- anyone looking for these gets a fake file with a password unique to their IP; if that password is typed into a login later, we know exactly whose it was and when.
- login pages
- WordPress, phpMyAdmin, Adminer, Jenkins and a generic admin login: real-looking pages that log everything typed into them and let nobody in.
- Shellshock
- checks every request header for the classic 2014 bash-bug pattern and logs what they tried to run.
- Telnet · 23
- pretends to be a weak router: accepts a login, hands over a fake shell, and logs what they'd try to download through it (how Mirai-style IoT botnets work).
- Redis · 6379
- answers OK to everything, as if it could be taken over (SLAVEOF, CONFIG SET, MODULE LOAD), so we see the whole attack chain, but runs nothing.
- FTP · 21, MySQL · 3306
- take and log the usual password-guessing attempts; there is no real file service or database behind either.
- SMTP · 25
- answers as if it were an open relay and would send the mail, but never actually sends anything; we just watch who they'd claim to be and who they'd try to reach.
- DNS · 53
- never replies to anything. A real open resolver can be tricked with a spoofed source address into flooding a victim with its reply (DDoS amplification); that abuse path was deliberately left out, this only watches who would ask.
WHAT WE LOG
- IP, time, and whatever belongs to the protocol: username, path tried, User-Agent, country and network (GeoLite2, kept fresh by CrowdSec).
- never: uploaded file contents, the text of typed passwords (only their length), mail body content.
- our own IP is excluded from every counter.
- what the log keeps lives on permanently in a SQLite database, not just in systemd's few days of journal retention.
OPEN DATA
The aggregated data (per day, service, country and network, without IP addresses) and the list of "campaigns" are refreshed hourly and free to download and reuse (CC BY 4.0): cyberzone.hu/data/
CrowdSec
Our real sites (not this one) are watched through a separate log: CrowdSec only sees that, and only bans based on it. The ban deliberately doesn't apply to the fake pages, so attackers stick around here and show us more.
Your IP (216.73.217.15) is not on the ban list, or you could not see this page.