TrapLayer Research

Weekly Threat Trends

Observed automation, scanner, prompt-attack, and canary activity across the TrapLayer decoy network.

4 weeks 12 weeks 26 weeks 52 weeks
Current week 7506 events observed this week
Previous week 8491 baseline comparison
Week over week -11.6% change in activity
Suspicious in period 78654 public-safe high-signal events

Weekly Activity

78654 total observed events in this period. Bars use a compressed visual scale when one week contains a major spike; numeric counts remain exact.

Total Suspicious
2026-07-20
20463 20463 suspicious
2026-07-27
42194 42194 suspicious
2026-08-03
8491 8491 suspicious
2026-08-10
7506 7506 suspicious

Visual scale compressed because the largest week is 42194 events. This prevents lower-volume weeks from disappearing while preserving exact labels.

Signal Mix

Threat Categories

Protocol Honeypot 53452 Interactive network services such as SSH, mail, SCADA, databases, cloud metadata, and DevOps lures.
Secret Harvest 24613 Attempts to retrieve credentials, environment files, tokens, or sensitive configuration.
Ics Probe 454 Industrial-control probing such as Modbus or SCADA-oriented interaction.
Ai Agent 85 AI-agent, MCP, tool-use, or prompt-oriented interaction.
Exploit Attempt 45 Sanitized public-safe attack category.
Prompt Attack 4 Sanitized public-safe attack category.
Spear Phishing 1 Sanitized public-safe attack category.

Protocol Exposure

Honeypot Breakdown

Protocol activity is split by the sensor surface that observed it.

SSH shell honeypot5347268.0% of selected-period sensor activity / max risk 93
Cloud metadata honeypot1107114.1% of selected-period sensor activity / max risk 92
MS SQL honeypot53786.8% of selected-period sensor activity / max risk 96
Redis/data-store honeypot28053.6% of selected-period sensor activity / max risk 96
MySQL honeypot26953.4% of selected-period sensor activity / max risk 96
PostgreSQL honeypot23513.0% of selected-period sensor activity / max risk 96
SCADA/Modbus honeypot4540.6% of selected-period sensor activity / max risk 95
DevOps lure1730.2% of selected-period sensor activity / max risk 95
SMTP mail honeypot1470.2% of selected-period sensor activity / max risk 91
AI agent/MCP honeypot920.1% of selected-period sensor activity / max risk 94
Other protocol honeypots160.0% of selected-period sensor activity / max risk 96

Current Pulse

Selected Period Detail

78562Scanner events 4Prompt attacks 24627Canary events 92AI-agent clients 96Maximum public risk score

Intelligence summary

Summary