Datasets · one-time

Buy the data once. Keep it.

Packaged extracts from the same sensors behind the live dashboard. One payment, no subscription, no expiry.

Raw events
corpus.ndjson
Addresses, file hashes, C2 URLs
iocs.csv
Window, exclusions, caps, licence, BibTeX
DATASHEET.md
Checksums
SHA256SUMS
Delivery
download link after payment

Packages

One zip per package. Prices in USD. Polar bills as merchant of record and handles local sales tax.

90 days

IoT botnet infection chain

The full sequence a commodity botnet runs against an exposed telnet device: the busybox probes, the write-directory handshake it uses to decide whether the host is worth infecting, the loader command, the fetched binary and its hash.

USD 129

  • Around 700,000 device commands and 41,000 executions a week, so the rare steps are present in quantity rather than as single examples.
Buy

Pay on Polar, download straight after.

In preparation, not yet on sale: CVE exploitation attempts in the wild; TLS and HTTP client fingerprints; LLM endpoint attack corpus; robben: multi-architecture Mirai via Langflow CVE-2025-3248. If one of these is the one you need, email [email protected] and it moves up the queue.

Use and scope

What you may do

  • Use it in research. Publish findings from it.
  • Cite it. Each bundle ships a BibTeX entry.
  • No resale. No redistribution of the corpus itself.
  • An institution that needs different terms can ask.

Scope

  • These are sensor logs. Most of it is mass scanning, commodity botnets and opportunistic exploitation of published CVEs.
  • The interesting captures are a minority. The datasheet states the proportion before you pay.
  • Self-test and operator traffic is filtered out before packaging. Any truncation is stated in the datasheet, not applied silently.
  • Nothing here supports attribution to named actors.
Citation

Zenodo DOIs are not minted yet. If a publication needs one, say so and a DOI is minted for your release.

Faulty file

If a file is faulty or does not match its datasheet, email [email protected] and it is fixed and reissued. Billing and any refund are handled by Polar as merchant of record under its own policy. Full terms at /terms.