RIGHT NOW ON THIS SENSOR
Loading current activity…
—sessions seen
—real campaigns fingerprinted
—left something on disk
—avg commands / session
How honeyfleet tells human from script
Not a black-box score. Every verdict is a weighted list of concrete evidence pulled from real session behavior — PTY allocation, keystroke timing, edit/backspace usage, think-time between commands. Click any session below to see its own evidence list.
The same attack script run from different IPs, at different times, with different filenames, dedups to the same fingerprint here. Sessions with zero commands never get fingerprinted — an empty session hashes the same as every other empty session, that's not a campaign match, just an artifact of nobody typing anything.
Click a session to open its full dossier. Repeat auth-only probes from the same source collapse into one row.
Select a session to see its full forensic dossier — cadence evidence, filesystem diff, and (when a shell was opened) a real terminal replay.