Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 488,541 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 17 times. Targeted ports: 22, 23. Country: Argentina.
Observed 36 times. Targeted ports: 161. Country: France.
Observed 12 times. Targeted ports: 22, 23. Country: Venezuela.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 6 times. Targeted ports: 2000. Country: China.
Observed 6 times. Targeted ports: 5985. Country: Bangladesh.
Observed 7 times. Targeted ports: 2567. Country: China.
Observed 6 times. Targeted ports: 2567. Country: China.
Observed 8 times. Targeted ports: 2567. Country: China.
Observed 5 times. Targeted ports: 2567. Country: China.
Observed 19 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 465. Country: United States.
Observed 8 times. Targeted ports: 22000. Country: United States.
Observed 9 times. Targeted ports: 445. Country: Brazil.
Observed 13 times. Targeted ports: 22, 23. Country: Ukraine.
Observed 10 times. Targeted ports: 22, 23. Country: Brazil.
Observed 1 times. Targeted ports: 53. Country: United States.
Observed 1 times. Targeted ports: 15236. Country: France. Reputation: known attacker.
Observed 10 times. Targeted ports: 23. Country: Germany. Reputation: known attacker.
Observed 4 times. Targeted ports: 25565. Country: The Netherlands.
Observed 23 times. Targeted ports: 22, 23. Country: Australia.
Observed 3 times. Targeted ports: 443. Country: United States.
Observed 122 times. Targeted ports: 1979. Country: United States.
Observed 14 times. Targeted ports: 443. Country: United States. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM ESTABLISHED SYN resend with different seq, SURICATA STREAM Packet with broken ack, SURICATA STREAM spurious retransmission.
Observed 6 times. Targeted ports: 5985. Country: India.
Observed 1 times. Targeted ports: 23. Country: Canada.
Observed 1 times. Targeted ports: 500. Country: United States.
Observed 20 times. Targeted ports: 445. Country: Bolivia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 2222. Country: United States.
Observed 4 times. Targeted ports: 23. Country: United States.
Observed 12 times. Targeted ports: 3389. Country: United States.
Observed 2278 times. Targeted ports: 1471, 1605, 2002, 2332, 3301, 3333, 4157, 5083, 5229, 5234, 5560, 5680, 6002, 6686, 7083, 7218, 7775, 8083, 8084, 8139, 8529, 8530, 8544, 8705, 8983, 9075, 9145, 9151, 9161, 9289, 9510, 9966, 9999, 11000, 12111, 15000, 15123, 16030, 18264, 20002, 21001, 22000, 25005, 25009, 30001, 32102, 35000, 44304, 44306, 49152, 49682, 52230, 52311. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction.
Observed 8 times. Targeted ports: 3389. Country: United States. Reputation: known attacker.
Observed 216 times. Targeted ports: 53, 1311, 1344, 1604, 1970, 3165, 3443, 3542, 3702, 4040, 4096, 4786, 4848, 5135, 5443, 7013, 7657, 8015, 8098, 8203, 8283, 8300, 8593, 8834, 8887, 9063, 9074, 9182, 9185, 9773, 10001, 15018, 19015, 19222, 20900, 24808, 30894, 32303, 49153, 51007, 52869, 60443, 64295. Country: United Kingdom. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 474 times. Targeted ports: 1153, 1180, 1414, 1741, 1801, 1980, 2100, 3388, 3478, 3510, 3541, 4063, 4242, 4430, 4572, 4899, 4949, 5001, 5225, 5242, 5915, 5985, 5997, 6080, 6100, 6170, 7070, 8014, 8082, 8096, 8099, 8110, 8123, 8190, 8503, 8520, 8585, 8594, 8606, 8764, 9050, 9066, 9091, 9116, 9119, 9150, 9164, 9177, 9350, 9710, 9734, 9943, 9988, 10000, 10003, 10065, 10399, 12000, 14401, 14402, 14404, 14901, 16800, 18081, 20001, 20880, 21081, 22103, 23424, 25007, 28015, 30000, 30123, 30443, 37777, 40005, 49502, 52931, 55554, 58443, 60030, 62865. Country: United Kingdom.
Observed 1 times. Targeted ports: 53. Country: Germany.
Observed 6 times. Targeted ports: 5985. Country: Russia.
Observed 21 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 44287. Country: Brazil.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 12 times. Targeted ports: 22, 23. Country: Argentina.
Observed 47 times. Targeted ports: 443. Country: South Korea. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 11 times. Targeted ports: 22, 23. Country: Ukraine.
Observed 18 times. Targeted ports: 27017. Country: Belgium. Reputation: known attacker.
Observed 1 times. Targeted ports: 5060. Country: Brazil.
Observed 4 times. Targeted ports: 27017. Country: Brazil.
Observed 3 times. Targeted ports: 80. Country: France.
Observed 6 times. Targeted ports: 22. Country: Ivory Coast.
Observed 20 times. Targeted ports: 445. Country: South Africa. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 9092. Country: China. Reputation: known attacker.
Observed 7 times. Targeted ports: 8443. Country: United States.
Observed 7 times. Targeted ports: 23. Country: Sweden.
Observed 5 times. Targeted ports: 3389. Country: United States. Reputation: known attacker.
Observed 20 times. Targeted ports: 22, 2222. Country: China. Reputation: known attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, ET INFO SSH session in progress on Unusual Port. Usernames: root.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 12 times. Targeted ports: 22, 23. Country: Ukraine.
Observed 2 times. Targeted ports: 5432. Country: United States. Reputation: known attacker.
Observed 2 times. Targeted ports: 22, 23. Country: Russia.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 4 times. Targeted ports: 23. Country: Argentina.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 7 times. Targeted ports: 3389. Country: United States.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 4 times. Targeted ports: 8873. Country: Taiwan.
Observed 46 times. Targeted ports: 10443. Country: United States.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 5 times. Targeted ports: 7000. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 9042. Country: United States.
Observed 5 times. Targeted ports: 62082. Country: China.
Observed 10 times. Targeted ports: 22, 23. Country: United States.
Observed 1 times. Targeted ports: 443. Country: China.
Observed 1 times. Targeted ports: 443. Country: China.
Observed 1 times. Targeted ports: 443. Country: China.
Observed 6 times. Targeted ports: 443. Country: China.
Observed 7 times. Targeted ports: 443. Country: China.
Observed 6 times. Targeted ports: 443. Country: China.
Observed 1 times. Targeted ports: 443. Country: China.
Observed 6 times. Targeted ports: 443. Country: China.
Observed 1 times. Targeted ports: 443. Country: China.
Observed 5 times. Targeted ports: 443. Country: China.
Observed 4 times. Targeted ports: 443. Country: China.
Observed 8 times. Targeted ports: 443. Country: China. Reputation: known attacker.
Observed 8 times. Targeted ports: 443. Country: China.
Observed 5 times. Targeted ports: 443. Country: China.
Observed 6 times. Targeted ports: 443. Country: China. Reputation: known attacker.
Observed 5 times. Targeted ports: 443. Country: China.
Observed 5 times. Targeted ports: 443. Country: China.
Observed 5 times. Targeted ports: 443. Country: China.
Observed 1 times. Targeted ports: 11633. Country: Bolivia. Reputation: known attacker.
Observed 6 times. Targeted ports: 3389. Country: India.
Observed 1288 times. Targeted ports: 80. Country: United States.
Observed 11 times. Targeted ports: 10465. Country: United States.
Observed 1 times. Targeted ports: 52929.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 19 times. Targeted ports: 445. Country: Bangladesh. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.