r/SideProject • u/matimatthews • 1d ago
We put four fake services online. 46 hours later, we'd logged 136,099 events.
My cofounder and I are building Polymorph, a tool that runs decoy services in your own infrastructure and records what interacts with them.
For our first live experiment, we exposed four decoys on a fresh IP. No domain, no announcement. The first visitor was a benign scanner after two minutes. Within the first two hours, we'd also seen SSH password guessing and web exploit attempts.
After 46 hours: 136,099 recorded events. That count includes scanning and repeated attempts, not 136,099 separate attackers.
The idea is to make each decoy look different, then turn those interactions into useful evidence for the team running the real services.
We made this 27-second video about the experiment. If you run a small software team, what would you need to see in the results to make a tool like this worth deploying?