Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 1 times. Targeted ports: 58843. Country: Australia.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 19 times. Targeted ports: 22, 23. Country: Pakistan.
Observed 7 times. Targeted ports: 23. Country: Pakistan.
Observed 320 times. Targeted ports: 5800, 5902, 5907, 5909, 5912, 5913, 5914, 5917, 5918, 5921, 5922, 5923, 5924, 5927, 5931, 5932, 5934, 5937, 5939, 5940, 5943, 5947, 5959, 5960, 5968, 5969, 5970, 5973, 5976, 5979, 5988, 5994, 6001, 6003, 6005, 6011, 6020, 6021, 6022, 6134, 6363, 6443, 6482, 6633, 7415, 9999, 10134. Country: Brazil.
Observed 8 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 53189. Country: Brazil. Reputation: known attacker.
Observed 1 times. Targeted ports: 50964. Country: Morocco.
Observed 11 times. Targeted ports: 3000. Country: United States.
Observed 5 times. Targeted ports: 23. Country: Ukraine.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 7 times. Targeted ports: 25, 137. Country: The Netherlands.
Observed 9 times. Targeted ports: 5555. Country: United States.
Observed 7 times. Targeted ports: 23. Country: Russia.
Observed 5 times. Targeted ports: 1433. Country: India.
Observed 5 times. Targeted ports: 53. Country: United States.
Observed 3 times. Targeted ports: 8443. Country: United States.
Observed 25 times. Targeted ports: 22. Country: South Korea. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: admin.
Observed 4 times. Targeted ports: 23. Country: Taiwan.
Observed 22 times. Targeted ports: 445. Country: Nigeria. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 2 times. Targeted ports: 20751, 23790. Country: Brazil.
Observed 5 times. Targeted ports: 1433. Country: China.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 21 times. Targeted ports: 445, 1433. Country: Türkiye. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 8 times. Targeted ports: 22. Country: Brazil.
Observed 1 times. Targeted ports: 12464. Country: Mexico. Reputation: known attacker.
Observed 20 times. Targeted ports: 22, 23. Country: Nepal.
Observed 7 times. Targeted ports: 23. Country: United Kingdom.
Observed 9 times. Targeted ports: 9006. Country: China.
Observed 38 times. Targeted ports: 3389, 3390. Country: Singapore. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA TLS invalid record type.
Observed 7 times. Targeted ports: 9006. Country: China.
Observed 7 times. Targeted ports: 9006. Country: China.
Observed 3 times. Targeted ports: 8443. Country: Ukraine.
Observed 3 times. Targeted ports: 8443. Country: Türkiye.
Observed 1 times. Targeted ports: 43514. Country: Kazakhstan.
Observed 1 times. Targeted ports: 33848. Country: United States.
Observed 541 times. Targeted ports: 1, 22, 80, 210, 222, 239, 492, 910, 1022, 1080, 1267, 2022, 2200, 2222, 2465, 3128, 3160, 3735, 4054, 4223, 5122, 5141, 5322, 5966, 5993, 6093, 7346, 8022, 8082, 8119, 8861, 8888, 12580, 19693, 23059, 24442, 30007, 43753, 44261, 44444, 46375, 47302, 48208, 51922, 65535. Country: Slovenia. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, ET INFO SSH session in progress on Unusual Port. Usernames: clay, root.
Observed 3 times. Targeted ports: 1433. Country: China.
Observed 1 times. Targeted ports: 23178. Country: Brazil.
Observed 5 times. Targeted ports: 23. Country: Argentina.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 6 times. Targeted ports: 3005. Country: China.
Observed 6 times. Targeted ports: 23. Country: China.
Observed 6 times. Targeted ports: 3005. Country: China.
Observed 8 times. Targeted ports: 3005. Country: China.
Observed 8 times. Targeted ports: 3005. Country: China. Reputation: known attacker.
Observed 22 times. Targeted ports: 445. Country: Brazil. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 11 times. Targeted ports: 3005. Country: China.
Observed 6 times. Targeted ports: 3005. Country: China.
Observed 1 times. Targeted ports: 360. Country: Sweden. Reputation: known attacker.
Observed 2 times. Targeted ports: 3306. Country: United States.
Observed 6 times. Targeted ports: 23. Country: Brazil.
Observed 1 times. Targeted ports: 57236. Country: Brazil.
Observed 1 times. Targeted ports: 12669. Country: Spain.
Observed 1 times. Targeted ports: 40215. Country: United States.
Observed 269 times. Targeted ports: 443, 3231, 4443, 5555, 8080, 8443, 9608, 29414. Country: Canada. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 2 times. Targeted ports: 8989, 25256. Country: Malaysia. Reputation: known attacker.
Observed 1 times. Targeted ports: 35696. Country: Brazil. Reputation: known attacker.
Observed 1 times. Targeted ports: 49935. Country: Brazil.
Observed 1 times. Targeted ports: 38141. Country: Brazil. Reputation: known attacker.
Observed 5 times. Targeted ports: 80. Country: Romania.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 68 times. Targeted ports: 23. Country: China.
Observed 28 times. Targeted ports: 22, 23. Country: United States.
Observed 14 times. Targeted ports: 23. Country: Italy.
Observed 13 times. Targeted ports: 47270, 54535. Country: United Kingdom.
Observed 9 times. Targeted ports: 3001. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 1 times. Targeted ports: 42528. Country: Brazil.
Observed 23 times. Targeted ports: 445. Country: Colombia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 24231. Country: Brazil.
Observed 27 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 6 times. Targeted ports: 23. Country: Ukraine.
Observed 1 times. Targeted ports: 38937. Country: United States.
Observed 8 times. Targeted ports: 80. Country: Iran.
Observed 22 times. Targeted ports: 445. Country: Ukraine. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 5900. Country: The Netherlands. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 8080. Country: Indonesia. Reputation: known attacker.
Observed 51 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Country: Indonesia.
Observed 8 times. Targeted ports: 23. Country: Ukraine.
Observed 5 times. Targeted ports: 23. Country: Brazil.
Observed 8 times. Targeted ports: 23. Country: United States.
Observed 8 times. Targeted ports: 22222. Country: China. Reputation: known attacker.
Observed 1 times. Targeted ports: 64611. Country: Türkiye.
Observed 19 times. Targeted ports: 445, 1433. Country: Iran. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 3 times. Targeted ports: 8443. Country: Russia.
Observed 3 times. Targeted ports: 8443. Country: Israel.
Observed 3 times. Targeted ports: 8443. Country: France.
Observed 13 times. Targeted ports: 22. Country: Kenya.
Observed 2 times. Targeted ports: 990. Country: Canada.
Observed 3 times. Country: China.
Observed 8 times. Targeted ports: 23. Country: Ukraine.
Observed 8 times. Targeted ports: 23. Country: Brazil.
Observed 4 times. Targeted ports: 3478, 7783, 7788, 8088. Country: United States. Reputation: known attacker.