Skip to content
AdminKit
API live

AdminKit Radar: exposure trends for machine protocols

Radar's API tracks how many MCP servers, MQTT brokers, Modbus devices, RTSP cameras, Telnet shells and DNS resolvers are reachable from the internet without authentication. The figures come from AdminKit's own honeypot sensors, published directly since that data involves no customer, plus any customer/tenant telemetry — which is only added in once at least 5 independent tenants corroborate it.

Updated

What Radar measures

Methodology

  • Passive and lightweight checks only — the same no-exploitation rules as AdminKit's public tools (see /security/).

  • AdminKit's own honeypot-sensor sightings are first-party data — they involve no customer — so they publish directly, with no minimum-contributor threshold.

  • Any customer/tenant contribution is only added to the same figures once at least 5 independent tenants corroborate it (k ≥ 5); below that, the tenant portion is omitted entirely, never shown as zero or approximated.

  • Reports show trends and aggregate counts only, never a specific IP address, device or organisation (the blocklist is the one exception: a corroborated-malicious IP, meant for blocking).

AdminKit's honeypot sensor is deployed and importing sightings every 10 minutes, and Radar's API is live — this page queries it directly. The per-protocol figures above are whatever the API currently reports: they may be sensor-only, or sensor data plus corroborated tenant contributions, depending on what has accumulated for that protocol.

Frequently asked questions

Can I query Radar's API directly?

Yes. GET /v1/radar/{protocol}/trends and /v1/radar/blocklist are live, public, and need no API key. AdminKit's own honeypot sensor is deployed and imports sightings every 10 minutes; those first-party counts publish directly, with no minimum-contributor threshold, because they are AdminKit's own data and involve no customer. Any customer/tenant contribution is only added to a protocol's figures once at least 5 independent tenants corroborate it.

What does "k ≥ 5" mean, and does it apply to everything?

It only applies to customer/tenant-contributed data: AdminKit only adds a tenant figure to a published count once at least 5 distinct, independent tenants make it up. Below that, the tenant contribution for that bucket is omitted entirely — never shown as zero or redacted. It does not apply to AdminKit's own first-party honeypot-sensor data, which carries no customer information and publishes without this threshold.

How does an IP end up on the blocklist?

Either because AdminKit's own honeypot sensors have observed it repeatedly — at least 3 hits across at least 2 distinct days, so a single stray connection never qualifies — or because at least 5 independent tenants have reported it. The listed report_count is the distinct-day count for sensor-only entries, or the distinct-tenant count once tenant corroboration applies.

Will Radar name specific vulnerable organisations or devices?

No. Radar publishes trends and aggregate counts by protocol only — never a specific IP address, domain or organisation (the one exception is the blocklist, which lists IPs corroborated as described above, for blocking). A verified asset owner can always see detail about their own assets through their AdminKit account.

Want Radar's view of the protocols you run?

Talk to our team about wiring Radar's public trends and blocklist into your stack, or about Netbase-built monitoring for a protocol you depend on.

Talk to our team Try the free tools