What is LightScope?

LightScope is a free, open source cybersecurity research initiative that examines unwanted traffic from attackers and scanners. LightScope is different from existing solutions as it turns closed ports on live machines into network telescopes/honeypots, and transparently forwards attacker traffic to USC managed honeypots. This removes the risk of running honeypots on production systems, and makes LightScope difficult for attackers to detect and avoid (unlike traditional honeypots and network telescopes). All this leads to better data for researchers and network operators.

LightScope is only interested in unwanted traffic attackers/scanners are sending you. If you're running a webserver or some other application, LightScope will ignore traffic to and from it. We only look at what gets sent to your closed ports, where no legitmate services are running.

LightScope partners with AbuseIPDB, and assists them with verifying whether observed scans/attacks are spoofed. This is an important problem, as malicious actors spoof competitor's IPs in order to get them added to blocklists. Prior to LightScope, AbuseIPDB and other services were forced to be conservative and not add IPs they couldn't verify, even if they observed a signficant amount of unwanted traffic.

The LightScope client is free, open source, extremely lightweight, and designed to run on production machines. If you install it you will be provided with rich information about who's targeting your network and tailored IP blocklists you can use to keep your network safe. Please click on one of the images below and select a public enpoint to view the type of data you will recieve.

LightScope is based upon work supported by the U.S. National Science Foundation under Grant No. 2313998 and the University of Southern California Information Sciences Institute.