A live map of who attacks us

Put a server on the public internet and it is under attack within minutes. Not a targeted attack, usually: just the endless background hum of scanners, credential-stuffers, and bots sweeping the entire address space looking for something soft. Most people who run infrastructure know this abstractly and never actually look at it. We decided to look, in real time, and then we made it public.

What it is

Watchtower is a live world map of every connection reaching our edge. Each source address is geolocated and drawn on the map the instant it arrives, streamed to your browser over server-sent events so there is no refreshing, no polling, just points lighting up as the traffic actually lands. Scans, probes, and login attempts appear as they happen. It's public at map.kitsunetechnologies.org.

How it's wired

The feed comes from the same reverse proxy and intrusion-protection layer that fronts our production services, so it is not a synthetic demo: it is our real traffic. Events flow from the edge into a small service that geolocates each source and pushes it out over a single long-lived SSE stream to every connected browser. Click any address and you can run a quick recon pass on it directly from the map. The whole thing is deliberately lightweight, one stream, no database in the hot path, so it stays live even when the traffic gets loud.

Why make it public

Two reasons. The useful one: seeing your attack surface as a live picture changes how you think about it. Patterns that hide in log files (a sweep walking through a subnet, a burst from one region, a login being hammered) are obvious the second they're on a map. The honest one: we think people should be able to see that "exposed to the internet" means "constantly attacked." It is not fear-mongering, it is just the weather. Watchtower is us pointing a camera at it.

Where it fits

Awareness is the cheapest layer of security and the one most often skipped. You cannot defend a shape you have never looked at. Watchtower is the observability half of the same work behind our protected hosting: the defenses matter, but so does simply seeing what is knocking. It started, like a lot of our tools, as us wanting to actually watch a thing we knew was happening but had only ever read about in logs.