Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 1 times. Targeted ports: 60760. Country: Brazil. Reputation: known attacker.
Observed 29 times. Targeted ports: 25, 587, 2525. Country: The Netherlands. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 11 times. Targeted ports: 2000, 8291. Country: United States. Reputation: known attacker.
Observed 22 times. Targeted ports: 445. Country: Brazil. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 23. Country: Russia.
Observed 5 times. Targeted ports: 22. Country: Belgium.
Observed 5 times. Targeted ports: 27017. Country: United States.
Observed 111 times. Targeted ports: 80. Country: France. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 1 times. Targeted ports: 15117. Country: Türkiye.
Observed 8 times. Targeted ports: 1525. Country: China.
Observed 12 times. Targeted ports: 23. Country: Taiwan.
Observed 21 times. Targeted ports: 22, 23. Country: Paraguay.
Observed 1 times. Targeted ports: 49821. Country: India.
Observed 48 times. Targeted ports: 3306, 27017. Country: Belgium.
Observed 30 times. Targeted ports: 22, 23. Country: Mexico.
Observed 16 times. Targeted ports: 80. Country: Germany.
Observed 5 times. Targeted ports: 110. Country: Belgium.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 30 times. Targeted ports: 22, 23. Country: Argentina.
Observed 24 times. Targeted ports: 445. Country: Thailand. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 9 times. Targeted ports: 1525. Country: China.
Observed 8 times. Targeted ports: 1525. Country: China.
Observed 10 times. Targeted ports: 1525. Country: China.
Observed 179 times. Targeted ports: 2323. Country: Pakistan.
Observed 24 times. Targeted ports: 7547. Country: Portugal. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 173 times. Targeted ports: 1991, 2375, 3790, 5560, 7547, 9000, 21025. Country: Portugal. Reputation: known attacker.
Observed 15 times. Targeted ports: 3790, 7547. Country: Portugal. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 23 times. Targeted ports: 7547, 9000, 21025. Country: Portugal. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 1 times. Targeted ports: 51456. Country: France.
Observed 9 times. Targeted ports: 23. Country: Spain.
Observed 36 times. Targeted ports: 1991, 5560, 7547. Country: Portugal. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 1 times. Targeted ports: 123. Country: Taiwan.
Observed 24 times. Targeted ports: 445. Country: India. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 13 times. Targeted ports: 22, 23. Country: Thailand.
Observed 6 times. Targeted ports: 443. Country: United States.
Observed 18 times. Targeted ports: 3790, 5560, 7547. Country: Portugal. Reputation: known attacker.
Observed 112 times. Targeted ports: 8086. Country: Germany.
Observed 509 times. Targeted ports: 6379, 27017. Country: Belgium. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction.
Observed 3 times. Targeted ports: 8443. Country: United Kingdom.
Observed 27 times. Targeted ports: 8443. Country: Ukraine. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 39021. Country: Chile. Reputation: known attacker.
Observed 5 times. Targeted ports: 23. Country: Ukraine.
Observed 19 times. Targeted ports: 22. Country: Moldova. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 32 times. Targeted ports: 1080. Country: The Netherlands. Reputation: known attacker. Usernames: 123456, admin.
Observed 13 times. Targeted ports: 22, 23. Country: Argentina.
Observed 27 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 34567. Country: Taiwan.
Observed 5 times. Targeted ports: 5433. Country: Australia.
Observed 37 times. Targeted ports: 1080. Country: The Netherlands. Usernames: 123456, 8598, admin.
Observed 56 times. Targeted ports: 1080. Country: The Netherlands. Usernames: 5555, no, test1, user.
Observed 28 times. Targeted ports: 22, 23. Country: United States.
Observed 30 times. Targeted ports: 22, 23. Country: Puerto Rico.
Observed 15 times. Targeted ports: 22. Country: Germany. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 7 times. Targeted ports: 21025. Country: Portugal. Reputation: known attacker.
Observed 35 times. Targeted ports: 1991, 2375, 3790, 5560, 21025. Country: Portugal. Reputation: known attacker.
Observed 36 times. Targeted ports: 3790, 5560, 9000, 21025. Country: Portugal. Reputation: known attacker.
Observed 5 times. Targeted ports: 23. Country: Ukraine.
Observed 42 times. Targeted ports: 2375, 9000, 21025. Country: Portugal. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 8 times. Targeted ports: 23. Country: Canada.
Observed 8 times. Targeted ports: 18000. Country: China.
Observed 3 times. Targeted ports: 1433. Country: Russia.
Observed 9 times. Targeted ports: 18000. Country: China.
Observed 7 times. Targeted ports: 18000. Country: China.
Observed 19 times. Targeted ports: 5560, 9000, 21025. Country: Portugal. Reputation: known attacker.
Observed 1 times. Targeted ports: 44564. Country: Mexico.
Observed 6 times. Targeted ports: 18000. Country: China.
Observed 7 times. Targeted ports: 23. Country: China.
Observed 8 times. Targeted ports: 4370. Country: United Kingdom.
Observed 3 times. Targeted ports: 1433. Country: China.
Observed 5 times. Targeted ports: 990. Country: Belgium.
Observed 15 times. Targeted ports: 23. Country: Colombia.
Observed 3 times. Targeted ports: 1433. Country: India.
Observed 49 times. Targeted ports: 445. Country: Sri Lanka. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 3 times. Targeted ports: 8443. Country: Russia.
Observed 3 times. Targeted ports: 8443. Country: Ukraine.
Observed 15 times. Targeted ports: 53807, 54331. Country: United Kingdom. Reputation: known attacker.
Observed 9 times. Targeted ports: 23. Country: United Arab Emirates.
Observed 1 times. Targeted ports: 11779. Country: United States. Reputation: known attacker.
Observed 2 times. Country: China.
Observed 15 times. Targeted ports: 2375. Country: China.
Observed 5 times. Targeted ports: 23. Country: Panama.
Observed 1 times. Targeted ports: 16933. Country: Brazil.
Observed 6 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 24318. Country: Brazil.
Observed 4 times. Targeted ports: 23. Country: Japan.
Observed 14 times. Targeted ports: 1080. Country: Slovenia. Reputation: known attacker. Usernames: 123.
Observed 12 times. Targeted ports: 22, 23. Country: South Africa.
Observed 5 times. Targeted ports: 1433. Country: Cambodia.
Observed 6 times. Targeted ports: 23. Country: China.
Observed 2 times. Targeted ports: 8080. Country: South Korea.
Observed 5 times. Targeted ports: 23. Country: Brazil.
Observed 11 times. Targeted ports: 5431. Country: United States.
Observed 1 times. Targeted ports: 63778. Country: Brazil. Reputation: known attacker.
Observed 28 times. Targeted ports: 1080. Country: The Netherlands. Usernames: 44, root.
Observed 785 times. Targeted ports: 21, 22, 23, 25, 26, 37, 49, 53, 79, 80, 81, 88, 94, 110, 111, 119, 120, 123, 143, 158, 179, 389, 427, 443, 444, 445, 465, 497, 500, 543, 544, 548, 554, 587, 626, 631, 636, 646, 873, 902, 990, 992, 993, 995, 996, 997, 998, 999, 1000, 1025, 1026, 1027, 1028, 1029, 1030, 1098, 1099, 1110, 1194, 1270, 1293, 1311, 1433, 1434, 1521, 1556, 1645, 1646, 1701, 1718, 1719, 1720, 1723, 1755, 1812, 1813, 1900, 2000, 2001, 2048, 2049, 2082, 2083, 2087, 2095, 2096, 2121, 2222, 2223, 2375, 2376, 3000, 3020, 3128, 3268, 3269, 3283, 3306, 3389, 3456, 3703, 4032, 4369, 4500, 5000, 5009, 5051, 5060, 5357, 5432, 5601, 5666, 5671, 5672, 5800, 5900, 5938, 5984, 5985, 5986, 6005, 6379, 7001, 7002, 7070, 7199, 7474, 7990, 8000, 8008, 8009, 8080, 8081, 8443, 8888, 9042, 9100, 9160, 9200, 9999, 10000, 10050, 10443, 11211, 27017, 32768, 32769, 32771, 32815, 49152, 49153, 49154, 49155, 49156, 49157, 50000. Country: United States. Reputation: known attacker. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM Packet with broken ack.
Observed 29 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 9 times. Targeted ports: 20009. Country: Hong Kong.