about me
I’m N0KEW, a licensed amateur radio operator and network enthusiast based in Saint Paul, Minnesota.
By day, I work in the networking industry. I’m not a cybersecurity professional, software developer, or academic researcher. This project exists simply because I’m curious about how networks behave, what shows up on the internet when nobody is looking, and how much can be learned by quietly observing.
I’ve been involved with computers, networking, and amateur radio for most of my life. Like many hams, I enjoy building things, experimenting with infrastructure, and occasionally taking apart systems just to understand how they work. The AMPRNet (44net) network combines several of those interests: radio, networking, internet routing, and a bit of old-school internet history.
What started as a simple experiment with unused AMPR address space eventually grew into a distributed honeypot network spanning multiple locations. The goal isn’t to catch attackers or collect intelligence. It’s simply to observe unsolicited traffic, document what appears on otherwise unused address space, and share interesting trends with anyone who finds the results useful.
Everything on this site is provided for educational and informational purposes. No raw attacker data, credentials, or personally identifiable information is published. The focus is on aggregate statistics, long-term trends, and understanding the background noise of the internet.
If you’re a fellow ham, network engineer, security enthusiast, or just someone who enjoys unusual internet projects, I hope you find something interesting here.
about this project
In 2026 I deployed a network of passive honeypot sensors across allocated 44net address space — IP ranges assigned to me as a licensed amateur radio operator through the AMPR registry. The sensors are distributed across five geographic locations and log all unsolicited inbound traffic to addresses that have never been used for any service and never advertised anywhere except the AMPR routing registry.
This page shows aggregate statistics from that data — what’s hitting the sensors, where it’s coming from, and what it’s looking for. Everything is updated periodically as a static snapshot. No raw attacker IPs, no credential data, nothing sensitive. The 44net angle is what makes this project unusual. That gets its own tab.
methodology
Each sensor node runs Zeek for network traffic analysis, with logs shipped to a central collector over an encrypted tunnel. Dionaea honeypot services (SMB, FTP) capture malware samples on nodes with sufficient resources. All data is aggregated and filtered before publication — source IPs are masked to the first two octets, no credentials or payload content are shown, and no data is retained beyond 90 days.
No active scanning is performed by any sensor node. All traffic shown was initiated by the remote party. The sensor addresses have never been used for any service and are not advertised outside the AMPR routing registry.