Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 5 times. Targeted ports: 443. Country: United Kingdom.
Observed 30 times. Targeted ports: 445. Country: Ukraine. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 18 times. Targeted ports: 27017. Country: France. Reputation: known attacker.
Observed 45 times. Targeted ports: 5910, 5915, 5944, 5959, 5964, 5978, 5995, 5999. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 20 times. Targeted ports: 3388, 3390, 33890, 33892, 63389. Country: The Netherlands.
Observed 5 times. Targeted ports: 22. Country: United Kingdom.
Observed 22 times. Targeted ports: 7474. Country: United States. Reputation: known attacker.
Observed 22 times. Targeted ports: 50000. Country: United States.
Observed 2 times. Targeted ports: 123. Country: Belgium.
Observed 54 times. Targeted ports: 445. Country: India. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 55434. Country: Brazil.
Observed 20 times. Targeted ports: 2323. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 443. Country: China.
Observed 26 times. Targeted ports: 9443, 27017. Country: Belgium.
Observed 4 times. Targeted ports: 27017. Country: The Netherlands.
Observed 3 times. Targeted ports: 513. Country: United States. Reputation: known attacker.
Observed 23 times. Targeted ports: 9000. Country: United States. Reputation: known attacker. Alert categories: Detection of a Network Scan. Signatures: ET SCAN Zmap User-Agent (Inbound).
Observed 8 times. Targeted ports: 3000. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 123. Country: China.
Observed 1 times. Country: United States.
Observed 23 times. Targeted ports: 445. Country: Türkiye. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 245 times. Targeted ports: 8008. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 49378. Country: Brazil.
Observed 24 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 11 times. Targeted ports: 80. Country: Belgium.
Observed 9 times. Targeted ports: 3306. Country: United States.
Observed 24 times. Targeted ports: 3387, 49672, 49692, 55378. Country: Germany.
Observed 2 times. Targeted ports: 8080. Country: Türkiye.
Observed 220 times. Targeted ports: 23. Country: Pakistan.
Observed 1 times. Targeted ports: 4590. Country: Canada.
Observed 7 times. Targeted ports: 23. Country: Hong Kong.
Observed 1 times. Targeted ports: 55789. Country: United States.
Observed 1 times. Targeted ports: 36800. Country: Mexico.
Observed 18 times. Targeted ports: 22. Country: Belgium.
Observed 7 times. Targeted ports: 5060. Country: United States.
Observed 12 times. Targeted ports: 22. Country: Belgium.
Observed 1 times. Targeted ports: 5070. Country: France. Reputation: known attacker.
Observed 3 times. Targeted ports: 19, 7782, 27961. Country: United States.
Observed 110 times. Targeted ports: 31337. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction.
Observed 1 times. Targeted ports: 7868. Country: Colombia.
Observed 1 times. Targeted ports: 59442. Country: Canada.
Observed 5 times. Targeted ports: 19236. Country: Hong Kong. Reputation: known attacker.
Observed 1 times. Targeted ports: 5060. Country: United States.
Observed 180 times. Targeted ports: 3283, 3360, 4000. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction.
Observed 1 times. Targeted ports: 1701. Country: United Kingdom. Reputation: known attacker.
Observed 13 times. Targeted ports: 80. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Request excessive header repetition.
Observed 7 times. Targeted ports: 5985. Country: Kosovo. Reputation: known attacker.
Observed 30 times. Targeted ports: 445. Country: China. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 6690. Country: Brazil. Reputation: known attacker.
Observed 31 times. Targeted ports: 12590. Country: United States.
Observed 13 times. Targeted ports: 5601. Country: United States.
Observed 3 times. Targeted ports: 1433. Country: Taiwan.
Observed 22 times. Targeted ports: 110, 2079, 4567, 7946. Country: United Kingdom. Reputation: known attacker.
Observed 5 times. Targeted ports: 7001. Country: United Kingdom. Reputation: known attacker.
Observed 1 times. Targeted ports: 60733. Country: India.
Observed 1 times. Targeted ports: 27812. Country: Zambia.
Observed 14 times. Targeted ports: 2455, 5005, 5060. Country: United Kingdom. Reputation: known attacker.
Observed 11 times. Targeted ports: 2078, 8987. Country: United Kingdom. Reputation: known attacker.
Observed 14 times. Targeted ports: 4002, 8484. Country: Singapore. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 9042. Country: United States.
Observed 20 times. Targeted ports: 80. Country: United States. Alert categories: Detection of a Network Scan. Signatures: ET SCAN Zmap User-Agent (Inbound).
Observed 6 times. Targeted ports: 23. Country: Israel.
Observed 26 times. Targeted ports: 1527, 1723, 2627, 3113, 44818. Country: United Kingdom. Reputation: known attacker.
Observed 10 times. Targeted ports: 465, 3030, 30303. Country: United States.
Observed 3 times. Targeted ports: 19853, 45777, 59059.
Observed 82 times. Targeted ports: 9092. Country: Germany. Reputation: known attacker.
Observed 15 times. Targeted ports: 9092. Country: Germany. Reputation: mass scanner.
Observed 244 times. Targeted ports: 9092. Country: Germany.
Observed 15 times. Targeted ports: 3280, 8092. Country: India. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 17 times. Targeted ports: 445. Country: China. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 2 times. Targeted ports: 6881. Country: Germany. Reputation: known attacker.
Observed 10 times. Targeted ports: 6996, 9814. Country: United Kingdom. Reputation: known attacker.
Observed 21 times. Targeted ports: 11740. Country: United States.
Observed 5 times. Targeted ports: 4000. Country: United States.
Observed 4 times. Targeted ports: 5060. Country: United States. Reputation: known attacker.
Observed 27 times. Targeted ports: 9092. Country: Germany. Reputation: known attacker.
Observed 14 times. Targeted ports: 9092. Country: Germany. Reputation: known attacker.
Observed 7 times. Targeted ports: 9092. Country: Germany. Reputation: known attacker.
Observed 5 times. Targeted ports: 3389. Country: Iran. Reputation: known attacker.
Observed 26 times. Targeted ports: 9092. Country: Germany. Reputation: known attacker.
Observed 26 times. Targeted ports: 9092. Country: Germany. Reputation: known attacker.
Observed 21 times. Targeted ports: 5269. Country: United States. Reputation: known attacker.
Observed 29 times. Targeted ports: 12172. Country: Germany. Reputation: known attacker.
Observed 9 times. Targeted ports: 3389. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 2 times. Targeted ports: 1434, 30301. Country: France. Reputation: known attacker.
Observed 25 times. Targeted ports: 5559, 5565. Country: Lithuania.
Observed 1 times. Targeted ports: 46551. Country: Ecuador. Reputation: known attacker.
Observed 14 times. Targeted ports: 5555. Country: South Korea.
Observed 1 times. Targeted ports: 52800. Country: Burkina Faso.
Observed 3563 times. Targeted ports: 1024, 1234, 1311, 1599, 1741, 1800, 1966, 1970, 2003, 2375, 2376, 2379, 2455, 2480, 2599, 3165, 3389, 3510, 3541, 3542, 4500, 5001, 5061, 5225, 5237, 5244, 5246, 5251, 5252, 5443, 5905, 5995, 6633, 7070, 7071, 7087, 7510, 8090, 8126, 8140, 8203, 8454, 8500, 8521, 8530, 8554, 8709, 8889, 8983, 9001, 9121, 9142, 9145, 9166, 9178, 9186, 9333, 9711, 9761, 9999, 10050, 10134, 10380, 10533, 11000, 11601, 11602, 11701, 12345, 14901, 14909, 15001, 15044, 19015, 20040, 20202, 20208, 20256, 21002, 22103, 22107, 22206, 23424, 25004, 25010, 32303, 32400, 35000, 41800, 44310, 44345, 51005, 51106, 60010. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction, SURICATA Applayer Mismatch protocol both directions, SURICATA TLS invalid record type.
Observed 6 times. Targeted ports: 445. Country: Egypt.
Observed 3531 times. Targeted ports: 1200, 1471, 2154, 2443, 3260, 3388, 3702, 4040, 4064, 4401, 4434, 4445, 4506, 4567, 4899, 5006, 5120, 5226, 5229, 5277, 5500, 5544, 5901, 5914, 5917, 5991, 6002, 6008, 6036, 6686, 6699, 6881, 7657, 7777, 8000, 8002, 8025, 8084, 8093, 8123, 8343, 8455, 8529, 8543, 8545, 8566, 8593, 8704, 8848, 9004, 9055, 9116, 9152, 9162, 9167, 9170, 9177, 9181, 9195, 9501, 9869, 9922, 9943, 10020, 11110, 11210, 12000, 14147, 14875, 14900, 15831, 16800, 19071, 20070, 20800, 21081, 21100, 25005, 28017, 49152, 50113, 50995, 51002, 55555, 58000, 62865, 63676. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction, SURICATA Applayer Mismatch protocol both directions, SURICATA HTTP Request line incomplete and 4 more.
Observed 43 times. Targeted ports: 10554. Country: United States.
Observed 9 times. Targeted ports: 25. Country: Uruguay.
Observed 1 times. Targeted ports: 39057. Country: Brazil.
Observed 15 times. Targeted ports: 1024, 1599, 5906. Country: United Kingdom. Reputation: known attacker.
Observed 86 times. Targeted ports: 22. Country: Vietnam. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, GPL ICMP Destination Unreachable Communication Administratively Prohibited. Usernames: admin, orangepi, root.
Observed 5 times. Targeted ports: 1433. Country: India.