Four Months of Running a Fake Water Utility

Some time ago I built a SCADA honeypot: a fake Siemens control system for a fictional German water utility, put on the public internet to see who comes knocking.

It has now been running for 126 days. In that time it logged 3,688,237 events from 25,423 unique IP addresses. Nobody has ever touched a real valve, because there are none: the pumps, the UV disinfection unit and the reservoir levels are a few hundred lines of JavaScript pretending to be a plant.

Here is what four months of unfiltered attack traffic actually looks like.

The first hour

The honeypot went live on 30 March at 03:15 in the morning. The first connection arrived at 03:15:02, two seconds later. It was a Modbus request, the industrial protocol that controls pumps and valves, from an address in the Alibaba Cloud range.

Within the first hour: 27 events from 3 different addresses. Within the first day: 16,332 events from 79 addresses.

Nobody had linked to it. It had no domain pointing at it, no search engine had indexed it. It was simply an IP address with open ports, and that is enough. The internet is scanned continuously, in full, by everyone.

What the traffic looks like

The baseline settled around 20,000 to 30,000 events per day. What stands out are the waves, the days where a single actor decides to spend real effort. The peak on 5 July brought 138,000 events in 24 hours, almost all of it from one VNC brute-force campaign.

Those waves are not gradual. They start within minutes, run for hours or days, and stop just as abruptly. You are not watching a rising tide of interest in your machine; you are watching individual campaigns sweep past.

Everybody wants the screen, not the plant

This surprised me the most. The honeypot exposes five ways in: a VNC server, SSH, the HTTP interface of the HMI, Modbus and S7comm, the last two being the actual industrial protocols.

VNC accounts for 59% of all traffic. Not the industrial protocols, not the web interface: remote desktop. The reason is grimly practical. A VNC session on an industrial machine gives you the operator's screen, exactly as the operator sees it, with no protocol knowledge required. You do not need to understand what register 40001 does if you can just look at the button labelled "Pump 1".

SSH is second at 1.1 million events, essentially all of it credential stuffing.

The industrial protocols come last: 29,590 Modbus events and 17,548 S7comm events. But look at the IP counts rather than the event counts, 1,490 and 1,774 distinct addresses respectively. Those are not a handful of specialists. Roughly one in fifteen addresses that touched this machine spoke an industrial protocol to it.

From scanning to actually doing something

This is the part I find genuinely interesting.

Of 25,423 addresses that touched the honeypot, 7,072 tried credentials at all. The rest connected, fingerprinted the service, and left, pure inventory work.

48 got in. The HMI login accepts admin / admin, which is the most-tried combination by a wide margin (44 of all attempts). It is not a hard door. Yet fewer than one in five hundred addresses that touched the machine walked through it.

And of those 48, 14 ever touched a control. Across four months, that is 202 control attempts and 30 setpoint changes in total.

The gap between "can get in" and "does anything" is enormous. The overwhelming majority of what looks like an attack is inventory: someone is building a list, and your machine is a row in it.

The press release

On 27 July at 20:40, an address in Egypt logged into the HMI with admin / admin. The session lasted six minutes and produced 589 log entries. Here is the complete breakdown of what it did:

login_attempt            admin / admin
view_process_overview    130×
view_alarms              132×
view_trends                1×
view_system_info           1×
view_diagnostics           1×
control_attempt            0
setpoint_change            0

Six minutes of clicking through read-only screens. No control command, no setpoint change, no write of any kind.

Some days later, a hacktivist group published an announcement. In their words, their engineers had "successfully breached the SCADA control interface (SIMATIC WinCC Runtime)" of a German municipal water utility, gained "full access to control units for water pumps (P-601, P-602, P-603) allowing complete manipulation of pressure and flow levels", infiltrated the UV disinfection unit, and were "feeding false telemetry to the central control rooms, disrupting logistics and disabling the distribution network".

Every asset in that list is a variable in my simulation file. The utility they named does not exist, and neither does the town it is supposedly in. And per the logs, they never sent a single command to any of it.

I am not writing this to mock anyone. It is a useful data point about how claims of critical-infrastructure compromise get made: a screenshot of an operator panel is apparently enough to declare an entire utility disabled. If a decoy that cost me a weekend produces that headline, it is worth asking how many similar claims describe something real.

What I would tell someone running the real thing

The scanning is not the threat, and it is also not optional. You cannot make yourself invisible. Two seconds after going online, before any DNS record existed, the first industrial protocol request arrived. Anything reachable is found, continuously, by dozens of independent scanners.

Watch VNC first. If you have one operator screen reachable from the internet, that is the highest-value target on your network, and the traffic data says attackers agree. It outweighed both industrial protocols combined by a factor of forty.

Default credentials are still the whole game. Not an exploit chain, not a zero-day: admin / admin, tried 44 times by different people.

Very few attackers know what to do once inside. That is not comfort, it only takes one who does. But it means detection has more room than it feels like: the transition from reading screens to writing setpoints is a sharp, rare, easily alertable event. If your monitoring catches nothing else, catch that.

The data is public

Every address that showed real intent, successful logins, control attempts, sustained brute force, ends up in a public blocklist, updated irregularly and released under CC0:

github.com/MuteBefehl/honeypot-blocklist

Currently 8,964 high-confidence and 5,844 medium-confidence addresses. Pure scanner noise is deliberately excluded, 11,780 addresses that only ever connected without trying anything are not in there, because a blocklist full of researchers and internet-wide surveys is worse than no blocklist.

The honeypot keeps running. If the next press release claims we lost the reservoir, you will know where to check.