Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 9 times. Targeted ports: 12303. Country: China.
Observed 8 times. Targeted ports: 12303. Country: China.
Observed 8 times. Targeted ports: 12303. Country: China.
Observed 5 times. Targeted ports: 12303. Country: China.
Observed 1 times. Targeted ports: 53250. Country: Brazil.
Observed 16 times. Targeted ports: 60001. Country: The Netherlands.
Observed 1 times. Targeted ports: 25558. Country: Brazil.
Observed 4 times. Targeted ports: 3389. Country: China.
Observed 6 times. Targeted ports: 8728. Country: United States. Reputation: known attacker.
Observed 28 times. Targeted ports: 8888. Country: United States.
Observed 6 times. Targeted ports: 10050. Country: United States. Reputation: known attacker.
Observed 5 times. Targeted ports: 27017. Country: United States.
Observed 1 times. Targeted ports: 26294. Country: Brazil. Reputation: known attacker.
Observed 6 times. Targeted ports: 8010. Country: United States. Reputation: known attacker.
Observed 29 times. Targeted ports: 1911. Country: United States.
Observed 8 times. Targeted ports: 23. Country: Guatemala.
Observed 1 times. Targeted ports: 3251. Country: South Africa.
Observed 47 times. Targeted ports: 4433. Country: United States. Reputation: known attacker.
Observed 27 times. Targeted ports: 60000. Country: United States.
Observed 29 times. Targeted ports: 8088. Country: United States.
Observed 1 times. Targeted ports: 56557. Country: Brazil.
Observed 103682 times. Targeted ports: 3389. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM ESTABLISHED SYN resend with different seq, SURICATA STREAM ESTABLISHED ack for ZWP data, SURICATA STREAM ESTABLISHED invalid ack and 3 more.
Observed 827 times. Targeted ports: 5500, 5800, 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909, 5910, 5911, 5912, 5913, 5916, 5918, 5919, 5920, 5921, 5922, 5926, 5928, 5930, 5931, 5932, 5933, 5934, 5935, 5936, 5937, 5938, 5939, 5940, 5941, 5942, 5943, 5944, 5945, 5946, 5947, 5948, 5949, 5950, 5951, 5952, 5953, 5957, 5958, 5959, 5960, 5961, 5962, 5963, 5964, 5965, 5966, 5967, 5969, 5970, 5971, 5972, 5973, 5974, 5975, 5977, 5979, 5980, 5981, 5982, 5983, 5984, 5985, 5986, 5987, 5989, 5990, 5991, 5992, 5993, 5994, 5995, 5996, 5998, 5999, 6000, 6002, 6004, 6005, 6006, 6007, 6008, 6009, 6010, 6011, 6020, 6021, 6022, 6036, 6050, 6060, 6070, 6080, 6081, 6100, 6102, 6262, 6363, 6443, 6482, 6500, 6512, 6633, 6653, 6667, 6697, 7000, 7001, 7415, 7434, 9000, 9999, 10000, 10002, 10134, 10348. Country: United States.
Observed 50 times. Targeted ports: 9201. Country: United States.
Observed 63702 times. Targeted ports: 3389. Country: Germany.
Observed 2003 times. Targeted ports: 3389. Country: Latvia.
Observed 9 times. Targeted ports: 445, 10443. Country: Poland.
Observed 1133 times. Targeted ports: 443, 1081, 1083, 1088, 1090, 1515, 1888, 2001, 2019, 3128, 3130, 3333, 4005, 4993, 5001, 5003, 5010, 5128, 5475, 5515, 5678, 6001, 6015, 6250, 6611, 6688, 6868, 7000, 7003, 7010, 7025, 7443, 7700, 7780, 7891, 7897, 8003, 8005, 8086, 8088, 8181, 8200, 8291, 8686, 8787, 8801, 8890, 9000, 9050, 9052, 9070, 9077, 9091, 9115, 9150, 9422, 9877, 9901, 9990, 9997, 10002, 10007, 10015, 10023, 10031, 10040, 10050, 10065, 10071, 10074, 10087, 10089, 10092, 10111, 10408, 10806, 10821. Country: The Netherlands. Reputation: known attacker.
Observed 10 times. Targeted ports: 8545. Country: The Netherlands.
Observed 1072 times. Targeted ports: 443, 1081, 1083, 1088, 1090, 1122, 1515, 1888, 2001, 2005, 2019, 2052, 3128, 3130, 3333, 4005, 4993, 5001, 5010, 5128, 5678, 6001, 6015, 6128, 6250, 6611, 6688, 6868, 7000, 7003, 7025, 7443, 7700, 7780, 7891, 7897, 8001, 8005, 8033, 8086, 8088, 8181, 8200, 8291, 8686, 8787, 8801, 8881, 8890, 9000, 9052, 9077, 9115, 9150, 9422, 9877, 9901, 9990, 9997, 10002, 10007, 10015, 10040, 10050, 10065, 10071, 10087, 10089, 10092, 10804, 10806, 10821. Country: The Netherlands. Reputation: known attacker.
Observed 667 times. Targeted ports: 5060. Country: United Kingdom.
Observed 3 times. Targeted ports: 115. Country: United States.
Observed 1 times. Targeted ports: 27367. Country: Uzbekistan.
Observed 28 times. Targeted ports: 8087. Country: United States.
Observed 24 times. Targeted ports: 7777. Country: United States. Reputation: known attacker.
Observed 23 times. Targeted ports: 445. Country: Pakistan. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 40 times. Targeted ports: 3388, 3397, 4446, 5691, 22112, 60548. Country: Russia.
Observed 2 times. Targeted ports: 43781, 49659. Country: Brazil.
Observed 2 times. Targeted ports: 443. Country: Mozambique. Reputation: known attacker.
Observed 3 times. Targeted ports: 389. Country: United States.
Observed 79 times. Targeted ports: 23, 80, 110, 465, 993, 1234, 1911, 2525, 4891, 8080, 8500, 9092, 10250, 11434, 20000. Country: Germany.
Observed 20 times. Targeted ports: 445. Country: Türkiye.
Observed 16 times. Targeted ports: 3389. Country: Germany.
Observed 1 times. Country: The Netherlands.
Observed 8 times. Targeted ports: 23. Country: Ukraine.
Observed 15 times. Targeted ports: 10000. Country: United States.
Observed 60 times. Targeted ports: 161. Country: Brazil. Reputation: known attacker.
Observed 6 times. Targeted ports: 40008. Country: Guatemala. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 17 times. Targeted ports: 1080. Country: United States.
Observed 1 times. Targeted ports: 9599. Country: Russia.
Observed 14 times. Targeted ports: 23. Country: Italy.
Observed 23 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 54 times. Targeted ports: 161. Country: Brazil. Reputation: known attacker.
Observed 11 times. Targeted ports: 18888. Country: China.
Observed 8 times. Targeted ports: 18888. Country: China.
Observed 9 times. Targeted ports: 18888. Country: China.
Observed 8 times. Targeted ports: 18888. Country: China.
Observed 6 times. Targeted ports: 18888. Country: China.
Observed 1 times. Targeted ports: 30503. Country: France.
Observed 30 times. Targeted ports: 9997. Country: Singapore. Reputation: known attacker.
Observed 1 times. Targeted ports: 29935. Country: Brazil.
Observed 17 times. Targeted ports: 445. Country: Bosnia and Herzegovina. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 24 times. Targeted ports: 8980. Country: United States. Reputation: known attacker.
Observed 6 times. Targeted ports: 5061. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 30722. Country: Colombia. Reputation: known attacker.
Observed 1 times. Targeted ports: 59111. Country: Bangladesh.
Observed 8 times. Targeted ports: 9007. Country: China.
Observed 7 times. Targeted ports: 9007. Country: China.
Observed 8 times. Targeted ports: 9007. Country: China.
Observed 10 times. Targeted ports: 9007. Country: China.
Observed 17 times. Targeted ports: 60001. Country: France.
Observed 5 times. Targeted ports: 9007. Country: China.
Observed 6773 times. Targeted ports: 445, 65533. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 29 times. Targeted ports: 8084. Country: United States.
Observed 5 times. Targeted ports: 23. Country: Morocco.
Observed 8 times. Targeted ports: 3260. Country: China.
Observed 14 times. Targeted ports: 80. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Request excessive header repetition.
Observed 9 times. Targeted ports: 3260. Country: China.
Observed 9 times. Targeted ports: 3260. Country: China. Reputation: known attacker.
Observed 9 times. Targeted ports: 3260. Country: China.
Observed 6 times. Targeted ports: 3260. Country: China. Reputation: known attacker.
Observed 10 times. Targeted ports: 443. Country: United States.
Observed 12 times. Targeted ports: 443. Country: United States.
Observed 2 times. Targeted ports: 11964, 33364. Country: Uzbekistan.
Observed 1 times. Targeted ports: 49859. Country: Azerbaijan.
Observed 3 times. Targeted ports: 5900. Country: United States. Reputation: known attacker.
Observed 9 times. Targeted ports: 8545. Country: Canada.
Observed 10 times. Targeted ports: 8545. Country: Canada.
Observed 3 times. Targeted ports: 1933, 21108, 42220. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 57773. Country: France.
Observed 1 times. Targeted ports: 39977. Country: Ireland.
Observed 1 times. Targeted ports: 54943. Country: Argentina.
Observed 11 times. Targeted ports: 8545. Country: The Netherlands.
Observed 3 times. Targeted ports: 82. Country: Singapore. Reputation: known attacker.
Observed 4 times. Targeted ports: 443. Country: South Korea.
Observed 2 times. Targeted ports: 27015. Country: Panama. Reputation: known attacker.
Observed 30 times. Targeted ports: 14000. Country: United States.
Observed 1 times. Targeted ports: 3679. Country: Mexico.
Observed 7 times. Targeted ports: 23. Country: Russia.
Observed 5 times. Targeted ports: 1433. Country: Venezuela.