February 15, 2026
Who’s there? Password bots, nonstop
Show HN: Knock-Knock.net – Visualizing the bots knocking on my server's door
A live globe of bot break-ins has commenters laughing and nervously changing passwords
TLDR: A new site turns nonstop bot login attempts into a live globe and stats. Commenters are split—some cheer the art, others say password logins are already doomed, and many suspect the bots run on hacked cloud servers—making this a vivid reminder that the internet is always knocking.
Knock-Knock.net is the internet’s creepiest doorbell cam: a live, 3D globe showing bots trying to log into a decoy server in real time. The maker turns the “background radiation of the Internet” into a show, with stats on where attacks come from, the most tried usernames and passwords, the “worst offender” providers, and even why some names pop up. It’s equal parts science project and jump scare, and the crowd can’t look away.
Hacker News lit up. The creator’s mic‑drop line — “Every server with port 22 open gets hammered by bots trying to brute-force SSH” (SSH = a way to log into a computer remotely) — set the tone. Curious sleuths asked whether the bots are running on already‑hacked machines and why the globe keeps pointing to certain hotspots like the Netherlands/DigitalOcean. Others wanted the play‑by‑play: do attacks start instantly when a server appears, or does it take time for the swarm to find it?
Meanwhile, the vibe war raged: art piece vs security PSA. One fan called it a “neat piece of art” (with a minor gripe about sideways scrolling). A grizzled admin splashed cold water, saying any server that still allows password logins was probably “0wned” ages ago, while multiple users nodded along about endless sprays of common username/password combos. Between knock‑knock jokes and nervous laughs, the takeaway was clear: this flashy site knock-knock.net makes invisible internet noise visible — and reminds everyone to lock their digital doors.
Key Points
- •Knock-knock.net visualizes automated bot login attempts to internet-connected machines.
- •The site offers a real-time live feed of login activity as it happens.
- •It aggregates historical statistics on attack origins and trends over time.
- •Commonly attempted usernames and passwords are tracked and displayed.
- •The platform highlights the most active ISPs and sometimes explains why certain credentials are targeted.