Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 486,198 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 6 times. Targeted ports: 2164. Country: China.
Observed 1 times. Targeted ports: 23. Country: China.
Observed 4 times. Targeted ports: 23. Country: Brazil.
Observed 4 times. Targeted ports: 23. Country: Argentina.
Observed 1 times. Targeted ports: 60889. Country: Venezuela.
Observed 5 times. Targeted ports: 443. Country: United States. Reputation: known attacker.
Observed 3 times. Targeted ports: 2222. Country: United States.
Observed 18 times. Targeted ports: 445. Country: United States. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 636. Country: Belgium.
Observed 1 times. Targeted ports: 30791. Country: Spain. Reputation: known attacker.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 16 times. Targeted ports: 8000. Country: China.
Observed 8 times. Targeted ports: 3389. Country: Belgium.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 5 times. Targeted ports: 23. Country: Russia.
Observed 9 times. Targeted ports: 20000. Country: The Netherlands.
Observed 18 times. Targeted ports: 8554. Country: Germany. Reputation: known attacker.
Observed 1 times. Targeted ports: 52306. Country: Ukraine.
Observed 4 times. Targeted ports: 445. Country: Vietnam.
Observed 1 times. Targeted ports: 13454. Country: Brazil.
Observed 4 times. Targeted ports: 9443. Country: United States.
Observed 21 times. Targeted ports: 445. Country: India. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 44562. Country: Brazil.
Observed 20 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Country: United States.
Observed 7 times. Targeted ports: 5038. Country: Mexico.
Observed 1 times. Targeted ports: 17430. Country: Brazil.
Observed 21 times. Targeted ports: 445. Country: United Arab Emirates. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 13 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 2 times. Targeted ports: 1433. Country: Iran.
Observed 4 times. Targeted ports: 10030. Country: China.
Observed 2 times. Targeted ports: 135. Country: Indonesia.
Observed 19 times. Targeted ports: 445. Country: China. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 465. Country: Portugal. Reputation: known attacker.
Observed 1 times. Targeted ports: 33201. Country: India.
Observed 3 times. Targeted ports: 22. Country: The Netherlands.
Observed 8 times. Targeted ports: 8006. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 62717. Country: United Kingdom. Reputation: known attacker.
Observed 13 times. Targeted ports: 2053. Country: China.
Observed 1 times. Targeted ports: 18404. Country: Mexico.
Observed 4 times. Targeted ports: 443. Country: United States. Reputation: known attacker.
Observed 2 times. Targeted ports: 123. Country: Belgium.
Observed 21 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 8080. Country: Singapore.
Observed 11 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 445. Country: Vietnam.
Observed 19 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 3 times. Targeted ports: 443. Country: Germany.
Observed 2 times. Targeted ports: 1433. Country: China.
Observed 16 times. Targeted ports: 9102. Country: United States.
Observed 7 times. Targeted ports: 22. Country: Venezuela. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission.
Observed 4 times. Targeted ports: 2222. Country: United States.
Observed 6 times. Targeted ports: 9092. Country: China.
Observed 6 times. Targeted ports: 9092. Country: China.
Observed 9 times. Targeted ports: 9092. Country: China.
Observed 8 times. Targeted ports: 9092. Country: China.
Observed 7 times. Targeted ports: 9092. Country: China.
Observed 8 times. Targeted ports: 3389. Country: Brazil.
Observed 18 times. Targeted ports: 8008. Country: United States. Reputation: known attacker.
Observed 9 times. Targeted ports: 445, 65533. Country: Pakistan.
Observed 5 times. Targeted ports: 6004. Country: China.
Observed 3 times. Targeted ports: 27740. Country: United States.
Observed 17 times. Targeted ports: 3389, 3390. Country: Canada. Reputation: known attacker.
Observed 4 times. Targeted ports: 23. Country: Ukraine.
Observed 21 times. Targeted ports: 52869. Country: Thailand. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Unexpected Request body.
Observed 5 times. Targeted ports: 1947. Country: China.
Observed 369 times. Targeted ports: 1111, 1234, 1414, 1515, 1919, 2020, 2222, 2323, 2345, 2424, 2626, 2727, 2828, 3232, 3535, 4141, 4321, 4444, 4545, 4567, 4646, 4848, 5151, 5454, 5555, 5656, 5858, 6161, 6262, 6363, 6543, 6666, 6789, 7070, 7171, 7272, 7373, 7575, 7654, 7777, 8181, 8383, 8585, 8686, 8765, 8787, 8989, 9090, 9393, 9595, 9797, 9876, 9898, 9999, 11111, 12345, 13389, 23389, 33890, 33891, 33892, 33893, 33894, 33896, 34567, 45678, 53389, 54321, 56789, 63389. Country: The Netherlands. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 4 times. Targeted ports: 5002. Country: China.
Observed 7 times. Targeted ports: 5002. Country: China.
Observed 6 times. Targeted ports: 5002. Country: China.
Observed 7 times. Targeted ports: 5002. Country: China.
Observed 6 times. Targeted ports: 5002. Country: China.
Observed 7 times. Targeted ports: 5002. Country: China.
Observed 8 times. Targeted ports: 5002. Country: China.
Observed 4 times. Targeted ports: 80. Country: Belgium.
Observed 4 times. Targeted ports: 80. Country: Belgium.
Observed 7 times. Targeted ports: 23. Country: United States.
Observed 1 times. Targeted ports: 23. Country: China.
Observed 7 times. Targeted ports: 18081. Country: China.
Observed 7 times. Targeted ports: 18081. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 7 times. Targeted ports: 18081. Country: China.
Observed 2 times. Targeted ports: 18081. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 19 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 80. Country: United States.
Observed 11 times. Targeted ports: 22, 23. Country: Argentina.
Observed 13 times. Targeted ports: 44444. Country: France. Reputation: known attacker. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM ESTABLISHED SYN resend with different seq.
Observed 11 times. Targeted ports: 22. Country: Vietnam. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: software.
Observed 1 times. Targeted ports: 16399. Country: South Africa.
Observed 1 times. Targeted ports: 12097.
Observed 23 times. Targeted ports: 22, 23. Country: United States.
Observed 10 times. Targeted ports: 3389. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 7 times. Targeted ports: 23. Country: Pakistan.
Observed 7 times. Targeted ports: 22. Country: Chile.
Observed 1 times. Targeted ports: 11989. Country: Brazil.
Observed 4 times. Targeted ports: 7415. Country: United States. Reputation: known attacker.
Observed 12 times. Targeted ports: 27739. Country: Hong Kong.
Observed 7 times. Targeted ports: 4444. Country: United States.
Observed 7 times. Targeted ports: 445. Country: Belgium.
Observed 7 times. Targeted ports: 445. Country: Belgium.
Observed 4 times. Targeted ports: 4444. Country: United States. Reputation: mass scanner.