Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 27 times. Targeted ports: 8001, 31380. Country: Singapore.
Observed 7 times. Targeted ports: 8868. Country: Singapore.
Observed 26 times. Targeted ports: 8079, 9995. Country: Singapore.
Observed 6 times. Targeted ports: 23. Country: China.
Observed 8 times. Targeted ports: 9994. Country: Singapore.
Observed 7 times. Targeted ports: 47335. Country: Singapore.
Observed 8 times. Targeted ports: 4789. Country: Singapore.
Observed 8 times. Targeted ports: 7700. Country: Singapore.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 172 times. Targeted ports: 3389. Country: Pakistan.
Observed 1 times. Targeted ports: 1628. Country: Brazil.
Observed 5 times. Targeted ports: 23. Country: Brazil.
Observed 80 times. Targeted ports: 33150, 34747, 35820, 37207, 38077, 47494, 50021, 51025, 52120. Country: Cambodia.
Observed 28 times. Targeted ports: 22, 23. Country: Tunisia.
Observed 56 times. Targeted ports: 3389. Country: Hong Kong. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 40 times. Targeted ports: 3306, 27017. Country: Belgium.
Observed 9 times. Targeted ports: 3307. Country: China.
Observed 11 times. Targeted ports: 3307. Country: China.
Observed 16 times. Targeted ports: 3307, 8529. Country: China.
Observed 6 times. Targeted ports: 3307. Country: China. Reputation: known attacker.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 12 times. Targeted ports: 22, 23. Country: Albania.
Observed 9 times. Targeted ports: 443, 8443. Country: The Netherlands. Reputation: known attacker.
Observed 1 times. Targeted ports: 29302. Country: Brazil.
Observed 9 times. Targeted ports: 5060. Country: Singapore.
Observed 6 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 27017. Country: United States.
Observed 6 times. Targeted ports: 23. Country: Taiwan.
Observed 1 times. Targeted ports: 63407. Country: Thailand.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 45448. Country: Morocco.
Observed 12 times. Targeted ports: 23. Country: Mexico.
Observed 1 times. Targeted ports: 35093. Country: Brazil.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 7 times. Targeted ports: 2085. Country: China.
Observed 8 times. Targeted ports: 2085. Country: China.
Observed 11 times. Targeted ports: 2085. Country: China.
Observed 8 times. Targeted ports: 2085. Country: China.
Observed 5 times. Targeted ports: 1433. Country: Pakistan.
Observed 1 times. Targeted ports: 27852. Country: Brazil. Reputation: known attacker.
Observed 1 times. Targeted ports: 9128. Country: Brazil.
Observed 9 times. Targeted ports: 23. Country: Uzbekistan.
Observed 18 times. Targeted ports: 23. Country: Sweden. Reputation: tor exit node. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM FIN recv but no session.
Observed 64 times. Targeted ports: 443. Country: Singapore. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 8 times. Targeted ports: 23. Country: Ukraine.
Observed 1 times. Targeted ports: 9078. Country: Uzbekistan.
Observed 23 times. Targeted ports: 8443. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 23 times. Targeted ports: 8443. Country: Seychelles. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 1 times. Targeted ports: 47567. Country: Brazil.
Observed 1 times. Targeted ports: 1900. Country: United Arab Emirates. Reputation: known attacker.
Observed 30 times. Targeted ports: 22, 23. Country: Algeria.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 5 times. Targeted ports: 23. Country: Argentina.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 45 times. Targeted ports: 22. Country: Iran. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: becker, ftpuser, lab, ts.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 23 times. Targeted ports: 22. Country: Singapore. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: irine, student.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 23 times. Targeted ports: 22. Country: Vietnam. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: accounts, ricardo.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 21 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: asia, blockchain.
Observed 16 times. Targeted ports: 22, 23. Country: Chile.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 21 times. Targeted ports: 22. Country: France. Reputation: known attacker. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: matthew.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 22 times. Targeted ports: 22. Country: France. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: demo2, root.
Observed 1 times. Targeted ports: 17966. Country: China.
Observed 1 times. Targeted ports: 18665. Country: Brazil. Reputation: known attacker.
Observed 27 times. Targeted ports: 22, 23. Country: Argentina.
Observed 5 times. Targeted ports: 23. Country: Iran.
Observed 46 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: anna, apache, bitcoin, sanders.
Observed 176 times. Targeted ports: 80, 443. Country: France. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP request missing protocol, SURICATA TLS invalid SNI length.
Observed 9 times. Targeted ports: 50997. Country: China.
Observed 7 times. Targeted ports: 50997. Country: China.
Observed 8 times. Targeted ports: 50997. Country: China.
Observed 9 times. Targeted ports: 50997. Country: China. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 6 times. Targeted ports: 50997. Country: China.
Observed 5 times. Targeted ports: 23. Country: Argentina.
Observed 24 times. Targeted ports: 22, 23. Country: Argentina.
Observed 45 times. Targeted ports: 22. Country: United States. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: bitcoin, blazestake, personal, smtp.
Observed 8 times. Targeted ports: 23. Country: Russia.
Observed 10 times. Targeted ports: 2053, 54321. Country: United States.
Observed 1 times. Targeted ports: 31630. Country: China.
Observed 1 times. Targeted ports: 31630. Country: China.