Most SSH intrusions are not independent attackers.
They are automated systems repeating the same behavior at scale.
NullRoute exists to measure that behavior directly - from live attacker interaction, not assumptions.
NullRoute is an independent behavioral threat intelligence research project built on live honeypot infrastructure.
It captures real attacker sessions across multiple sensors operated in different regions and studies what happens after access is obtained: command flow, persistence, tooling, sequencing, and repeatable tradecraft.
The goal is not to count noise. It is to isolate real intrusions, reduce them to deterministic behavioral patterns, and publish findings that can be verified from observed activity.
NullRoute publishes behavioral investigations based on real attacker activity. Each report focuses on patterns that persist across sessions, infrastructure, and time.
Instead of tracking individual attackers, the analysis focuses on systems, automation, and repeatable behavior.
Start with the first investigation: 98% of SSH Intrusions Come from One Worm.
NullRoute operates a distributed set of internet-exposed sensors designed to collect real attacker interaction data under controlled conditions.
Events are normalized, correlated, and reviewed through a custom analysis pipeline focused on post-auth behavior, session structure, and repeatability across nodes.
Research is published only when a pattern is supported by direct observation and can be described as behavior rather than inference.
All analysis is deterministic. No machine learning, no probabilistic models. Every classification is derived from observable behavior and can be reproduced from raw session data.
Most security telemetry is dominated by noise. NullRoute focuses on the subset that matters: sessions where attackers successfully authenticate and execute commands.
The goal is not to track more data, but to reduce it - until only meaningful behavior remains.
NullRoute currently operates multiple sensors across several countries.
The infrastructure includes both general-purpose and purpose-built systems with distinct exposure profiles, credential surfaces, and collection goals. Nodes are operated independently to observe how attacker behavior changes across environments rather than within a single repeated setup.
This allows the project to compare recurring tradecraft, validate patterns across separate systems, and distinguish broad background activity from behavior that is specific, deliberate, and reproducible.
NullRoute is a private research project by Jan Steck. Built to answer questions that dashboards don't ask: what do attackers actually do, why, and what does it mean?
If you're analyzing SSH logs, running honeypots, or investigating intrusion patterns, start with the first investigation:
→ 98% of SSH Intrusions Come from One Worm
Correction: Erratum #1 - credential model correction published March 2026
Additional investigations will be published as patterns are validated across the dataset.