Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 32 times. Targeted ports: 8887. Country: United States.
Observed 33 times. Targeted ports: 1443, 4431, 4433, 4434, 4437, 5443, 6443, 8443. Country: Kazakhstan. Reputation: known attacker.
Observed 31 times. Targeted ports: 12532. Country: Germany.
Observed 1 times. Targeted ports: 7837. Country: South Africa.
Observed 2 times. Targeted ports: 5060. Country: Germany.
Observed 1 times. Targeted ports: 36035. Country: Russia.
Observed 2 times. Targeted ports: 23. Country: Brazil.
Observed 28 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 12 times. Targeted ports: 21. Country: United States.
Observed 1 times. Targeted ports: 53050. Country: Brazil.
Observed 1 times. Country: Hong Kong. Reputation: known attacker.
Observed 3 times. Targeted ports: 143. Country: Canada.
Observed 1 times. Targeted ports: 14101. Country: Brazil.
Observed 10 times. Targeted ports: 8545. Country: United Kingdom.
Observed 1 times. Targeted ports: 11041. Country: Ecuador.
Observed 28 times. Targeted ports: 445. Country: Colombia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 3731. Country: Russia.
Observed 261 times. Targeted ports: 3381. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 44153. Country: Brazil.
Observed 1 times. Targeted ports: 42378. Country: Brazil.
Observed 29 times. Targeted ports: 4431, 4432, 4436, 4437, 4438, 44310. Country: Kazakhstan. Reputation: known attacker.
Observed 6 times. Targeted ports: 8545. Country: The Netherlands.
Observed 2 times. Targeted ports: 21034, 22847. Country: United States.
Observed 25 times. Targeted ports: 8022. Country: United States. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 1 times. Targeted ports: 3389. Country: United States. Reputation: known attacker.
Observed 20 times. Targeted ports: 3381. Country: United States. Reputation: known attacker.
Observed 5 times. Targeted ports: 3381. Country: United States.
Observed 1 times. Targeted ports: 56535. Country: Brazil.
Observed 282 times. Targeted ports: 6379. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction, SURICATA TLS invalid record type.
Observed 22 times. Targeted ports: 5001. Country: Seychelles.
Observed 5 times. Targeted ports: 53. Country: United States.
Observed 17 times. Targeted ports: 22. Country: China. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 8 times. Targeted ports: 2233. Country: China. Reputation: known attacker.
Observed 5 times. Targeted ports: 80. Country: Switzerland.
Observed 10 times. Targeted ports: 80. Country: Belgium. Reputation: known attacker.
Observed 2 times. Targeted ports: 23. Country: Macao.
Observed 15 times. Targeted ports: 22. Country: China.
Observed 9 times. Targeted ports: 9009. Country: China.
Observed 10 times. Targeted ports: 9009. Country: China.
Observed 6 times. Targeted ports: 9009. Country: China.
Observed 28 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 33162. Country: Bangladesh.
Observed 1 times. Targeted ports: 32602. Country: Brazil.
Observed 257 times. Targeted ports: 3380. Country: United States. Reputation: known attacker.
Observed 8 times. Targeted ports: 110. Country: United States.
Observed 4 times. Targeted ports: 110. Country: United States. Reputation: mass scanner.
Observed 44 times. Targeted ports: 8087, 9300. Country: United States. Reputation: known attacker.
Observed 14 times. Targeted ports: 443. Country: United States.
Observed 7 times. Targeted ports: 30019. Country: China.
Observed 7 times. Targeted ports: 30019. Country: China.
Observed 7 times. Targeted ports: 30019. Country: China.
Observed 6 times. Targeted ports: 30019. Country: China.
Observed 6 times. Targeted ports: 23. Country: Armenia.
Observed 44 times. Targeted ports: 9001. Country: United States.
Observed 1 times. Targeted ports: 5653. Country: China.
Observed 28 times. Targeted ports: 445. Country: Vietnam. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 3 times. Targeted ports: 25689. Country: Albania.
Observed 1 times. Targeted ports: 53191. Country: Colombia.
Observed 20 times. Targeted ports: 22. Country: China. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 1 times. Targeted ports: 45072. Country: Colombia.
Observed 6 times. Targeted ports: 23. Country: Ukraine.
Observed 6 times. Targeted ports: 1723. Country: Germany.
Observed 1 times. Targeted ports: 28826. Country: Brazil. Reputation: known attacker.
Observed 1 times. Targeted ports: 56245. Country: Argentina. Reputation: known attacker.
Observed 1 times. Targeted ports: 14368. Country: China.
Observed 13 times. Targeted ports: 2379. Country: United States.
Observed 1 times. Targeted ports: 2584. Country: Bolivia.
Observed 1 times. Targeted ports: 25828. Country: United States.
Observed 1 times. Targeted ports: 28756. Country: Colombia.
Observed 26 times. Targeted ports: 123, 161, 260, 500, 1740, 1741, 1742, 1743, 3401, 3478, 9600, 44818, 47808. Country: United Kingdom.
Observed 140 times. Targeted ports: 80, 88, 443, 808, 1000, 5101, 6030, 6443, 6969, 7788, 8000, 8008, 8080, 8081, 8088, 8089, 8090, 8443, 8888, 8899, 8989, 8999, 9090, 9091, 9999, 18080, 28080. Country: China.
Observed 73 times. Targeted ports: 80, 443, 2077, 2078, 2082, 2083, 2086, 2087, 2095, 2096. Country: United States.
Observed 22 times. Targeted ports: 5094. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 55107. Country: Vietnam.
Observed 26 times. Targeted ports: 443, 2443, 3443, 4435, 5443, 10443. Country: United Kingdom. Reputation: known attacker.
Observed 27 times. Targeted ports: 445. Country: Vietnam. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 2 times. Targeted ports: 23. Country: China.
Observed 6 times. Targeted ports: 23. Country: United States.
Observed 1 times. Targeted ports: 32432. Country: Ukraine.
Observed 1 times. Targeted ports: 54942. Country: Brazil.
Observed 1 times. Targeted ports: 7896. Country: Mexico.
Observed 1 times. Targeted ports: 13369. Country: Brazil.
Observed 7 times. Targeted ports: 7687. Country: China.
Observed 1 times. Targeted ports: 17625. Country: Brazil.
Observed 8 times. Targeted ports: 7687. Country: China.
Observed 10 times. Targeted ports: 7687. Country: China.
Observed 8 times. Targeted ports: 7687. Country: China.
Observed 6 times. Targeted ports: 7687. Country: China.
Observed 1 times. Targeted ports: 20767. Country: Brazil.
Observed 1 times. Targeted ports: 56047. Country: Brazil.
Observed 47 times. Targeted ports: 443. Country: United States.
Observed 12 times. Targeted ports: 44554. Country: India. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 6 times. Targeted ports: 443. Country: United States.
Observed 1 times. Targeted ports: 39596. Country: Sweden.
Observed 1 times. Targeted ports: 20939. Country: South Korea.
Observed 8 times. Targeted ports: 3389. Country: India.
Observed 1 times. Targeted ports: 4035. Country: Brazil.
Observed 2 times. Targeted ports: 26084, 38152. Country: Mexico.
Observed 1 times. Targeted ports: 5100. Country: Argentina.
Observed 1 times. Targeted ports: 9465. Country: France.