Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 1 times. Targeted ports: 25451. Country: Italy.
Observed 1 times. Targeted ports: 20852. Country: Brazil. Reputation: known attacker.
Observed 5 times. Targeted ports: 80. Country: United States.
Observed 1 times. Targeted ports: 47647. Country: Brazil.
Observed 4 times. Targeted ports: 5433. Country: Taiwan.
Observed 24 times. Targeted ports: 445. Country: Guatemala. Alert categories: Generic Protocol Command Decode, Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use, SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 48314. Country: United States.
Observed 8274 times. Targeted ports: 80, 83, 443, 808, 999, 1065, 1080, 1081, 1082, 1083, 1084, 1085, 1088, 1101, 1111, 1234, 1452, 2080, 2610, 3125, 3127, 3128, 3129, 4040, 4145, 5050, 5101, 5102, 5110, 5111, 5701, 5702, 5703, 5704, 5705, 5706, 5707, 5710, 5711, 5712, 5713, 5714, 5715, 5716, 5717, 5718, 6789, 6969, 7070, 7777, 7890, 7891, 7897, 8000, 8010, 8080, 8081, 8082, 8083, 8085, 8087, 8088, 8090, 8118, 8181, 8443, 8585, 8787, 8800, 8818, 8888, 8889, 8899, 9000, 9007, 9009, 9010, 9011, 9012, 9016, 9017, 9018, 9019, 9022, 9024, 9025, 9027, 9032, 9033, 9034, 9035, 9037, 9041, 9047, 9049, 9050, 9060, 9066, 9071, 9072, 9073, 9076, 9077, 9079, 9080, 9083, 9090, 9091, 9098, 9099, 9101, 9102, 9103, 9104, 9105, 9106, 9108, 9110, 9400, 9401, 9443, 9595, 9999, 10000, 10001, 10002, 10003, 10004, 10005, 10006, 10007, 10008, 10009, 10010, 10011, 10013, 10014, 10015, 10017, 10018, 10019, 10021, 10022, 10023, 10025, 10026, 10027, 10085, 10800, 10804, 10808, 10809, 12001, 12002, 12004, 12005, 12006, 12007, 12009, 12011, 12016, 12019, 12020, 12023, 12025, 12028, 12030, 12031, 12345, 12402, 17981, 18080, 18255, 18888, 20170, 20171, 20221, 22000, 22035, 22037, 22041, 22069, 22071, 22116, 22187, 22221, 22222, 22311, 22329, 22351, 22384, 22387, 22389, 22401, 22422, 22470, 22501, 22542, 22599, 22612, 22637, 22655, 22664, 30004, 30097, 30100, 30101, 30102, 30103, 30105, 30106, 30108, 30111, 30112, 30113, 30115, 30117, 30118, 30122, 30123, 30125, 30126, 30128, 30129, 30149, 30151, 30626, 31280, 31357, 32121, 32140, 32530, 32679, 33115, 33224, 33275, 33777, 34281, 34305, 34545, 34565, 34663, 34873, 34895, 35198, 35405, 35710, 36159, 36209, 36275, 36543, 36691, 37207, 39351, 40000, 41123, 41565, 42003, 42520, 42536, 42558, 42568, 42708, 43041, 46009, 46309, 47058, 49641, 50000, 51295, 52207, 52917, 54063, 54795, 55555, 56789, 58080, 62606, 62771, 64587, 64832. Country: Vietnam.
Observed 28 times. Targeted ports: 8808. Country: United States.
Observed 1 times. Targeted ports: 28716. Country: Pakistan.
Observed 1 times. Targeted ports: 2543. Country: Brazil.
Observed 13 times. Targeted ports: 8040. Country: United States. Reputation: known attacker.
Observed 18 times. Targeted ports: 5555. Country: Germany.
Observed 1 times. Targeted ports: 24298. Country: Brazil.
Observed 1 times. Targeted ports: 2510. Country: Brazil.
Observed 1 times. Targeted ports: 18037. Country: Brazil.
Observed 5 times. Targeted ports: 445. Country: Hong Kong.
Observed 8 times. Targeted ports: 3128. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 4768. Country: Brazil. Reputation: known attacker.
Observed 1 times. Targeted ports: 13725. Country: Colombia.
Observed 14 times. Targeted ports: 2222. Country: China. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 1 times. Targeted ports: 9886. Country: Brazil.
Observed 8 times. Targeted ports: 9045. Country: China.
Observed 21 times. Targeted ports: 22, 2222. Country: China. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, ET INFO SSH session in progress on Unusual Port. Usernames: root.
Observed 6 times. Targeted ports: 23. Country: Indonesia.
Observed 1 times. Targeted ports: 50986. Country: Chile.
Observed 7 times. Targeted ports: 10000. Country: China.
Observed 24 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 13727. Country: Brazil.
Observed 5 times. Targeted ports: 53. Country: United States.
Observed 5 times. Targeted ports: 9046. Country: China.
Observed 8 times. Targeted ports: 9046. Country: China.
Observed 9 times. Targeted ports: 9046. Country: China.
Observed 7 times. Targeted ports: 9046. Country: China.
Observed 9 times. Targeted ports: 9046. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 5 times. Targeted ports: 9046. Country: China.
Observed 23 times. Targeted ports: 9160. Country: United States. Alert categories: Detection of a Network Scan. Signatures: ET SCAN Zmap User-Agent (Inbound).
Observed 1 times. Targeted ports: 10216. Country: Brazil. Reputation: known attacker.
Observed 1 times. Targeted ports: 15575. Country: Brazil.
Observed 7 times. Targeted ports: 5985. Country: Pakistan.
Observed 7 times. Targeted ports: 9045. Country: China.
Observed 6 times. Targeted ports: 9045. Country: China.
Observed 5 times. Targeted ports: 9045. Country: China.
Observed 26 times. Targeted ports: 4444. Country: United States. Reputation: known attacker. Alert categories: Detection of a Network Scan, Generic Protocol Command Decode. Signatures: ET SCAN Zmap User-Agent (Inbound), SURICATA Applayer Detect protocol only one direction.
Observed 1 times. Targeted ports: 25431. Country: Morocco.
Observed 24 times. Targeted ports: 445. Country: Mexico. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 50625. Country: Ecuador.
Observed 6 times. Targeted ports: 443. Country: United States.
Observed 11 times. Targeted ports: 10000. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP missing Host header.
Observed 7 times. Targeted ports: 10000. Country: China.
Observed 1 times. Targeted ports: 60868. Country: United States. Reputation: known attacker.
Observed 7 times. Targeted ports: 10000. Country: China.
Observed 5 times. Targeted ports: 10000. Country: China.
Observed 9 times. Targeted ports: 10000. Country: China.
Observed 1 times. Targeted ports: 28906. Country: Brazil.
Observed 1 times. Targeted ports: 26951. Country: Brazil. Reputation: known attacker.
Observed 8 times. Targeted ports: 9044. Country: China.
Observed 9 times. Targeted ports: 9044. Country: China.
Observed 1 times. Targeted ports: 51042. Country: Spain.
Observed 8 times. Targeted ports: 9044. Country: China.
Observed 28 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 22 times. Targeted ports: 445. Country: Thailand. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 253 times. Targeted ports: 5094. Country: Canada. Reputation: known attacker.
Observed 7 times. Targeted ports: 8600. Country: China.
Observed 27 times. Targeted ports: 8001. Country: United States.
Observed 8 times. Targeted ports: 8600. Country: China. Reputation: known attacker.
Observed 250 times. Targeted ports: 8250. Country: United States. Reputation: known attacker.
Observed 5 times. Targeted ports: 2351. Country: Finland.
Observed 7 times. Targeted ports: 9043. Country: China.
Observed 5 times. Targeted ports: 9043. Country: China.
Observed 13 times. Targeted ports: 18091. Country: United States. Reputation: known attacker.
Observed 10 times. Targeted ports: 8600, 13579. Country: China. Reputation: known attacker.
Observed 10 times. Targeted ports: 9043. Country: China.
Observed 14 times. Targeted ports: 8600, 9036. Country: China.
Observed 7 times. Targeted ports: 9043. Country: China. Reputation: known attacker.
Observed 1 times. Targeted ports: 18669. Country: Argentina.
Observed 7 times. Targeted ports: 9043. Country: China. Reputation: known attacker.
Observed 5 times. Targeted ports: 9043. Country: China.
Observed 40 times. Targeted ports: 80. Country: Thailand.
Observed 1 times. Targeted ports: 13884. Country: Brazil.
Observed 9 times. Targeted ports: 9042. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 10 times. Targeted ports: 9042. Country: China.
Observed 8 times. Targeted ports: 9042. Country: China.
Observed 7 times. Targeted ports: 9042. Country: China.
Observed 1 times. Targeted ports: 5094. Country: Germany.
Observed 8 times. Targeted ports: 9042. Country: China. Reputation: known attacker.
Observed 5 times. Targeted ports: 9042. Country: China.
Observed 33 times. Targeted ports: 8443. Country: Germany. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 7496 times. Targeted ports: 22. Country: The Netherlands. Reputation: known attacker. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: a, aaa, admin, admin1, admin123 and 233 more.
Observed 1 times. Targeted ports: 1434. Country: Germany.
Observed 8 times. Targeted ports: 9041. Country: China.
Observed 1 times. Targeted ports: 58930. Country: Colombia.
Observed 1 times. Targeted ports: 3389. Country: Canada.
Observed 1 times. Targeted ports: 15714. Country: United States.
Observed 7 times. Targeted ports: 9041. Country: China.
Observed 10 times. Targeted ports: 9041. Country: China.
Observed 8 times. Targeted ports: 9041. Country: China.
Observed 6 times. Targeted ports: 9041. Country: China.
Observed 5 times. Targeted ports: 389. Country: Morocco.
Observed 6 times. Targeted ports: 5094. Country: United States. Reputation: known attacker.