// 3 vantage points · 14d window

The internet you see depends on where you stand.

ECHO runs identically-configured sensors on 3 continents — same decoy stack, same listeners, same software. If attackers swept the internet uniformly, each sensor would see roughly the same addresses. They do not. 77% of the addresses that touched a decoy touched exactly one of them. A feed built from a single vantage point is not wrong, but it is describing its own neighborhood.

Per vantage point

// how much of what each sensor sees is unique to it

United States · N. Virginia

59%

seen here and nowhere else

2,358 of 4,018 addresses

Singapore

56%

seen here and nowhere else

2,117 of 3,787 addresses

Germany · Frankfurt

57%

seen here and nowhere else

2,161 of 3,784 addresses

Pairwise overlap

// Jaccard similarity — shared addresses over combined total

Singapore∩United States · N. Virginia

20%

1,308 of 6,497 shared

Singapore∩Germany · Frankfurt

20%

1,271 of 6,300 shared

Germany · Frankfurt∩United States · N. Virginia

19%

1,261 of 6,541 shared

How many vantage points saw each address

// out of 3 reporting

production infrastructure only — never touched a decoy

7,687

47%

a single vantage point

6,636

41%

2 of 3 vantage points

1,113

every vantage point

909

// the zero row is not an error — 7,687 addresses reached production infrastructure without ever touching a decoy. Opportunistic scanning finds honeypots because honeypots are what is listening; traffic that skips them is a more selective population.

How source networks spread

// per-address reach, not just which networks appear where

Nearly every large source network reaches all 3 vantage points, so asking which regions an ASN touches separates almost nothing. What separates them is how far each individual address ranges — one machine scanning three continents is a different operation from three hundred machines each scanning their own.

Network	Addrs	Avg reach	One only	All	Pattern
AS211298 Driftnet Ltd	765	2.79/3	25	628	Concentrated
AS4766 Korea Telecom	208	1.86/3	87	58	Distributed
AS401626 Netiface America, Inc.	30	1.50/3	17	2	Distributed
AS209334 Modat B.V.	53	1.42/3	34	3	Distributed
AS396982 Google LLC	825	1.40/3	556	64	Distributed
AS398324 Censys, Inc.	369	1.40/3	245	25	Distributed
AS4760 HKT Limited	28	1.39/3	18	1	Distributed
AS9304 HGC Global Communications Limited	120	1.35/3	83	5	Distributed
AS63949 Akamai Connected Cloud	34	1.35/3	24	2	Distributed
AS16509 Amazon.com, Inc.	38	1.34/3	30	5	Distributed
AS6939 Hurricane Electric LLC	173	1.24/3	136	4	Distributed
AS14061 DigitalOcean, LLC	250	1.22/3	210	14	Distributed
AS3257 GTT Communications Inc.	133	1.23/3	106	3	Distributed
AS25369 Hydra Communications Ltd	483	1.17/3	406	6	Distributed

Concentrated — individual hosts scan every vantage — few machines, many targets

Distributed — the network reaches everywhere but its addresses do not — source rotation, or many hosts each scanning locally

Regional — the network itself only turns up at some vantage points

Method and limits

// what these numbers do and don't say

Every figure covers decoy traffic over the last 14 days at 3 sensors running identical software. Ratios are normalized by the number of reporting vantage points, so they stay comparable as sensors are added.

Distributed is ambiguous. A network whose addresses each hit one vantage point could be deliberately rotating source IPs, or could be a botnet of many hosts each scanning locally. This data cannot tell those apart, and the label is not claiming to.

Known scanning organizations are deliberately not filtered out here, even though they are excluded from the blocklist feeds. They are among the most interesting rows on the page — removing them would delete the finding.

// aggregate only — no addresses are published, and nothing here says which host any actor reached

// source /api/echo/regions · generated 2026-10-22 17:22Z · 909 addresses seen everywhere