Ваш сайт будуть атакувати з першої секунди в інтернеті: А хто? Навіщо? Як саме?

What happens to a site in the first minutes after it appears on the Internet? We decided not to guess, but to check. We set up our own honeypot, left it running for almost a month and received tens of thousands of real attacks, hundreds of thousands of events and unexpected conclusions. In this stream, we will show what modern automated Internet scanning looks like, who is actually hunting for .env, .git, secrets and old CVEs, and why most attacks have long been carried out not by people, but by huge bot networks. We will analyze the most interesting experiment separately. We put a special AWS Canarytoken in a fake .env and for the first time were able to see the full chain of secret theft. It turned out that the one who finds the key is almost never the one who checks it in AWS. Authorization is recorded not by our server, but by the AWS infrastructure via Thinkst Canarytokens, after which we correlate this data with our logs. This is how we managed to see the individual stages of the pipeline: scrapers, validators and the infrastructure through which stolen credentials walk. We will also show statistics from the last night after enabling "retaliation". Our passive mechanisms are already forcing bots to waste their own resources: dozens of ZIP bombs, dozens of tarpit delays, hundreds of seconds of wasted time and dozens of gigabytes of meaningless unpacking. All this without hack-back, without active attacks in response and without breaking the law. Let's talk about: what does Internet scanning look like in 2026; which CVEs are still massively exploited; who is attacking: Contabo, DigitalOcean, Alibaba, M247 and other data centers; why secrets are more valuable than RCE; how honeypots and Canarytokens work; how we analyzed bots using AI; what can be done to protect your own services today. If you are interested in .NET, DevOps, cybersecurity, system design, or just want to see what happens to a new server in the first hours of its life — join the stream. 💬 Write questions in the chat — we will analyze real logs, show code, and analyze attacks live.