RDP THREAT DEFENSE HTMX + ABUSEIPDB

Decoy Honeypot // Authentic NLA Prompt // AbuseIPDB & DroneBL Intelligence
LISTENING :3390
Total Attacks
...
Last 24 Hours
...
Unique IPs
...
Credentials Intercepted
...
Blocked IPs (Active)
...
Decoy Listener Control
:3390
Router Port-Forwarding: External 3389 → the honeypot's listening port shown above. Change the port here and the setting is saved.
Take over moves the real RDP to 3391 and puts the honeypot on 3389, so attacker logins land here and we capture username + hash. Needs Administrator. Fully reversible.
Reputation: AbuseIPDB (API Key verified) + DroneBL + ip-api (Cached in SQLite)
Global Threat Map
0 locations
Live Intrusion Log
Real-time intrusion detection and penalty enforcement
Auto-Block Armed
Loading intrusion log...
Windows RDP Failed Logons
Real usernames logged by the system RDP service (Security Event 4625)
Event 4625
Loading...
Transparent Relay (divert port → real RDP)
Passes bytes straight through to the system RDP. No TLS interception, goroutine-per-connection, ~0 added latency. Usernames appear in the Windows panel above.
stopped
Listen Port
Target Host
Target Port
Blocked IPs & Auto-Ban Policy
0 blocked
Sources are blocked only after real credential attempts. Fingerprint probes are never counted.
Attempts Allowed
Window (min)
Ban For (min)
Retention (days)
Whitelist (comma separated)
Real usernames (optional)
Loading blocks...
Attack Velocity (Last 24 Hours)
Attacker Tools & Fingerprints
Top Attacker Countries
Targeted Usernames
Live Threat Stream
Loading threats stream...