Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 1 times. Targeted ports: 7350. Country: Türkiye.
Observed 1 times. Targeted ports: 40120. Country: Ukraine.
Observed 1 times. Targeted ports: 4202. Country: Italy. Reputation: known attacker.
Observed 5 times. Targeted ports: 23. Country: United States.
Observed 31 times. Targeted ports: 22. Country: China. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 1 times. Targeted ports: 20176. Country: Brazil.
Observed 13 times. Targeted ports: 2379. Country: United States. Reputation: known attacker.
Observed 2 times. Targeted ports: 587. Country: Vietnam.
Observed 253 times. Targeted ports: 7000, 9030. Country: United States.
Observed 5 times. Targeted ports: 2167. Country: China.
Observed 8 times. Targeted ports: 23. Country: Taiwan.
Observed 7 times. Targeted ports: 2167. Country: China.
Observed 1 times. Targeted ports: 3283. Country: United Kingdom. Reputation: known attacker.
Observed 1 times. Targeted ports: 41164. Country: Brazil.
Observed 1 times. Targeted ports: 34344. Country: Ecuador. Reputation: known attacker.
Observed 1 times. Targeted ports: 1434. Country: United States. Reputation: known attacker.
Observed 2 times. Targeted ports: 990. Country: Japan.
Observed 1 times. Targeted ports: 1291. Country: Brazil.
Observed 1 times. Targeted ports: 31125. Country: Belgium.
Observed 5 times. Targeted ports: 443. Country: United Kingdom.
Observed 24 times. Targeted ports: 445. Country: Pakistan. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 22. Country: United Kingdom.
Observed 1 times. Targeted ports: 1900. Country: Poland.
Observed 7 times. Targeted ports: 445. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 15165. Country: Brazil.
Observed 1 times. Targeted ports: 19378. Country: Brazil.
Observed 245 times. Targeted ports: 6666. Country: United States.
Observed 14 times. Targeted ports: 44818. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 22104. Country: Brazil.
Observed 1 times. Targeted ports: 44242. Country: Chile.
Observed 1 times. Targeted ports: 47491. Country: Russia.
Observed 20 times. Targeted ports: 49152. Country: United States. Reputation: known attacker.
Observed 131 times. Targeted ports: 23. Country: Pakistan.
Observed 6 times. Targeted ports: 23. Country: Malaysia.
Observed 1 times. Targeted ports: 47453. Country: Bangladesh.
Observed 1 times. Targeted ports: 34322. Country: Brazil.
Observed 14 times. Targeted ports: 10000, 12313. Country: China.
Observed 8 times. Targeted ports: 12313. Country: China.
Observed 10 times. Targeted ports: 12313. Country: China.
Observed 7 times. Targeted ports: 12313. Country: China.
Observed 7 times. Targeted ports: 12313. Country: China.
Observed 5 times. Targeted ports: 12313. Country: China.
Observed 1 times. Targeted ports: 62396. Country: Spain.
Observed 5 times. Targeted ports: 53. Country: United States.
Observed 4 times. Targeted ports: 554, 981. Country: United States.
Observed 1 times. Targeted ports: 15717. Country: Serbia. Reputation: known attacker.
Observed 1 times. Targeted ports: 60012. Country: Ireland.
Observed 247 times. Targeted ports: 9191. Country: United States.
Observed 30 times. Targeted ports: 8787. Country: United States. Reputation: known attacker.
Observed 25 times. Targeted ports: 445. Country: Kenya. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 13 times. Targeted ports: 10002. Country: Seychelles.
Observed 1 times. Targeted ports: 27015. Country: China. Reputation: known attacker.
Observed 1 times. Targeted ports: 3389. Country: Brazil.
Observed 23 times. Targeted ports: 445. Country: Ethiopia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 55 times. Targeted ports: 445. Country: Brazil. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 23. Country: The Netherlands. Reputation: bot, crawler.
Observed 7 times. Targeted ports: 9869. Country: China.
Observed 8 times. Targeted ports: 9869. Country: China. Reputation: known attacker.
Observed 7 times. Targeted ports: 9869. Country: China.
Observed 7 times. Targeted ports: 9869. Country: China.
Observed 8 times. Targeted ports: 9869. Country: China.
Observed 5 times. Targeted ports: 9869. Country: China.
Observed 5 times. Targeted ports: 6666. Country: United States. Reputation: known attacker.
Observed 20 times. Targeted ports: 445, 1433. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 27 times. Targeted ports: 389. Country: Iran.
Observed 1 times. Targeted ports: 16748. Country: Brazil.
Observed 6 times. Targeted ports: 5901. Country: India. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 41532. Country: Brazil.
Observed 29 times. Targeted ports: 12441. Country: United States.
Observed 8 times. Targeted ports: 16010. Country: China.
Observed 8 times. Targeted ports: 16010. Country: China.
Observed 10 times. Targeted ports: 16010. Country: China.
Observed 9 times. Targeted ports: 16010. Country: China.
Observed 5 times. Targeted ports: 16010. Country: China.
Observed 31 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 16 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 8 times. Targeted ports: 10002. Country: China. Reputation: known attacker.
Observed 1 times. Targeted ports: 18794. Country: Bangladesh.
Observed 1 times. Targeted ports: 60505. Country: Uruguay.
Observed 21 times. Targeted ports: 2380. Country: United States.
Observed 3 times. Targeted ports: 1433. Country: Spain.
Observed 8 times. Targeted ports: 2185. Country: China.
Observed 7 times. Targeted ports: 2185. Country: China.
Observed 15 times. Targeted ports: 2185, 10000. Country: China.
Observed 5 times. Targeted ports: 2185. Country: China.
Observed 8 times. Targeted ports: 9300. Country: China.
Observed 9 times. Targeted ports: 9300. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 10 times. Targeted ports: 15900, 15901. Country: United States.
Observed 5 times. Targeted ports: 9300. Country: China.
Observed 10 times. Targeted ports: 9300. Country: China.
Observed 21 times. Targeted ports: 8087. Country: United States.
Observed 9 times. Targeted ports: 80, 83, 89. Country: Germany.
Observed 1 times. Targeted ports: 44524. Country: Brazil.
Observed 5 times. Targeted ports: 80. Country: United States.
Observed 23 times. Targeted ports: 9043. Country: United States. Reputation: known attacker.
Observed 11 times. Targeted ports: 22. Country: United States. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 633 times. Targeted ports: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909, 5910, 5911, 5912, 5913, 5914, 5915, 5916, 5917, 5918, 5919, 5920, 5921, 5922, 5923, 5924, 5925, 5926, 5927, 5928, 5929, 5930, 5931, 5932, 5933, 5934, 5935, 5936, 5937, 5938, 5939, 5940, 5942, 5943, 5944, 5945, 5946, 5947, 5948, 5949, 5950, 5951, 5952, 5953, 5954, 5955, 5956, 5957, 5958, 5959, 5960, 5961, 5962, 5963, 5965, 5966, 5967, 5968, 5969, 5970, 5971, 5972, 5973, 5974, 5975, 5976, 5977, 5978, 5979, 5980, 5981, 5982, 5983, 5984, 5985, 5986, 5987, 5988, 5989, 5990, 5991, 5992, 5993, 5994, 5995, 5996, 5997, 5998, 5999, 6000. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 50 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 13 times. Targeted ports: 4331. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 38992. Country: Brazil.