Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 67 times. Targeted ports: 22. Country: Hong Kong. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: clark, express, mayachain, nelly, root and 1 more.
Observed 22 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: career, dispatch.
Observed 46 times. Targeted ports: 22. Country: Japan. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: brenda, everstake, lenny, ubuntu.
Observed 24 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root, token.
Observed 68 times. Targeted ports: 22. Country: Singapore. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: aida, backup, root, test1, token.
Observed 1 times. Targeted ports: 4500. Country: United States.
Observed 4 times. Targeted ports: 3389. Country: Switzerland.
Observed 47 times. Targeted ports: 22. Country: United States. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: account, mim, test2, zb.
Observed 68 times. Targeted ports: 22. Country: United States. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: azureuser, kristina, mobile, root, share.
Observed 8 times. Targeted ports: 23. Country: Martinique.
Observed 35 times. Targeted ports: 22. Country: South Korea. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: ann, root, wallet.
Observed 25 times. Targeted ports: 22. Country: Singapore. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: finance, marie.
Observed 5 times. Targeted ports: 23. Country: Brazil.
Observed 12 times. Targeted ports: 22. Country: France. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 21 times. Targeted ports: 22. Country: Germany. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: buchhaltung, martim.
Observed 1 times. Targeted ports: 33754. Country: Ecuador.
Observed 46 times. Targeted ports: 22. Country: Taiwan. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: confroom, ftp, imap, scanner.
Observed 118 times. Targeted ports: 9301. Country: United States.
Observed 46 times. Targeted ports: 22. Country: United States. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: cdk, marta, newsletter, root.
Observed 33 times. Targeted ports: 445. Country: Argentina. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 67 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: boss, ec2-user, fax, info, kai and 1 more.
Observed 45 times. Targeted ports: 22. Country: United States. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: erigon, frax, spam, wallet.
Observed 65 times. Targeted ports: 22. Country: Iran. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: pam, philip, root, root2, support and 1 more.
Observed 45 times. Targeted ports: 22. Country: Singapore. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: ad, centos, rafael, root.
Observed 2 times. Targeted ports: 8080. Country: The Netherlands.
Observed 55 times. Targeted ports: 22. Country: India. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: alina, elise, ipo, js, webmaster.
Observed 69 times. Targeted ports: 22. Country: Iran. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: citrix, kadiatou, lidia, printer, root and 1 more.
Observed 43 times. Targeted ports: 22. Country: Spain. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: it, root, wallet, zksync.
Observed 1 times. Targeted ports: 20153. Country: Ivory Coast.
Observed 1 times. Targeted ports: 14177. Country: United Kingdom.
Observed 67 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: john, kiosk, liz, root, testuser and 1 more.
Observed 56 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: crypto, ec2-user, information, root, sia.
Observed 27 times. Targeted ports: 445. Country: Ukraine. Reputation: known attacker. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 22 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: administrator, tower.
Observed 45 times. Targeted ports: 22. Country: United Arab Emirates. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: demo, test, ubuntu, user1.
Observed 44 times. Targeted ports: 22. Country: United States. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: buchhaltung, catalog, root, strace.
Observed 25 times. Targeted ports: 22. Country: China. Reputation: known attacker. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: ubuntu, wallet.
Observed 48 times. Targeted ports: 22. Country: South Korea. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: accounts, country, digital, root.
Observed 5 times. Targeted ports: 1433. Country: China.
Observed 8 times. Targeted ports: 22222. Country: China. Reputation: known attacker.
Observed 22 times. Targeted ports: 22. Country: Russia. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: adele, max.
Observed 20 times. Targeted ports: 22. Country: United Kingdom. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: export, scans.
Observed 70 times. Targeted ports: 22. Country: South Korea. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: crypto, elaine, help, polygon, pruebas and 1 more.
Observed 63 times. Targeted ports: 22. Country: Germany. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: bruce, empleos, prova, test2, utente and 1 more.
Observed 45 times. Targeted ports: 22. Country: Indonesia. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: discover, info, jade, root.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 8 times. Targeted ports: 2223. Country: China.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 3 times. Targeted ports: 1433. Country: India.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 8 times. Targeted ports: 2222. Country: China. Reputation: known attacker.
Observed 41 times. Targeted ports: 3389, 3390. Country: United States.
Observed 8 times. Targeted ports: 18245. Country: China.
Observed 9 times. Targeted ports: 18245. Country: China.
Observed 8 times. Targeted ports: 18245. Country: China.
Observed 11 times. Targeted ports: 18245. Country: China.
Observed 8 times. Targeted ports: 18245. Country: China.
Observed 8 times. Targeted ports: 9042. Country: China.
Observed 9 times. Targeted ports: 9042. Country: China.
Observed 8 times. Targeted ports: 9042. Country: China.
Observed 5 times. Targeted ports: 9042. Country: China.
Observed 1 times. Targeted ports: 46925. Country: United States.
Observed 61 times. Targeted ports: 445. Country: Peru. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 6 times. Targeted ports: 23. Country: China.
Observed 21 times. Targeted ports: 22, 23. Country: Türkiye.
Observed 6 times. Targeted ports: 23. Country: Taiwan.
Observed 1 times. Targeted ports: 10648. Country: United States.
Observed 68 times. Targeted ports: 80, 443, 1194, 4443, 8080, 8443, 9201. Country: United States.
Observed 84 times. Targeted ports: 2053, 54321. Country: United States.
Observed 2 times. Targeted ports: 1433. Country: China. Reputation: known attacker.
Observed 47 times. Targeted ports: 2323. Country: India.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 5 times. Targeted ports: 1433. Country: Croatia.
Observed 5 times. Targeted ports: 1433. Country: India.
Observed 68 times. Targeted ports: 22. Country: United States. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: coolcats, louis, maximus, milena, office and 1 more.
Observed 5 times. Targeted ports: 23. Country: Pakistan.
Observed 6 times. Targeted ports: 18245. Country: China.
Observed 2 times. Targeted ports: 5436, 16953. Country: Brazil.
Observed 26 times. Targeted ports: 22, 23. Country: United States.
Observed 6 times. Targeted ports: 23. Country: China.
Observed 171 times. Targeted ports: 3389. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 12 times. Targeted ports: 3389. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 34471. Country: Sint Maarten.
Observed 28 times. Targeted ports: 445. Country: Iran. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 8 times. Targeted ports: 22. Country: Argentina.
Observed 10 times. Targeted ports: 8899. Country: United States.
Observed 8 times. Targeted ports: 22. Country: Argentina.
Observed 2 times. Targeted ports: 2401, 31863. Country: Brazil.
Observed 20 times. Targeted ports: 22, 23. Country: Vietnam.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 23 times. Targeted ports: 8443. Country: Seychelles. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 24 times. Targeted ports: 8443. Country: Russia. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 269 times. Targeted ports: 27017. Country: Belgium.
Observed 3 times. Targeted ports: 1433. Country: India.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 5 times. Targeted ports: 5005. Country: China.
Observed 1 times. Targeted ports: 53549. Country: Brazil.
Observed 11 times. Targeted ports: 22. Country: France. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: bitstamp.
Observed 8 times. Targeted ports: 5985. Country: Iran.
Observed 11 times. Targeted ports: 23. Country: China.