Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 478,937 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 5 times. Targeted ports: 8443. Country: United States.
Observed 1 times. Targeted ports: 14180. Country: Brazil.
Observed 1 times. Targeted ports: 443. Country: Singapore. Reputation: known attacker.
Observed 5 times. Targeted ports: 3327. Country: United States. Reputation: known attacker.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 26680. Country: Brazil.
Observed 5 times. Targeted ports: 10134. Country: United States. Reputation: known attacker.
Observed 9 times. Targeted ports: 22, 23. Country: Saudi Arabia.
Observed 52 times. Targeted ports: 27816. Country: Hong Kong. Reputation: known attacker.
Observed 13 times. Targeted ports: 23. Country: China. Usernames: admin.
Observed 1 times. Targeted ports: 7199. Country: United States. Reputation: known attacker.
Observed 11 times. Targeted ports: 17001. Country: Brazil.
Observed 8 times. Targeted ports: 8443. Country: United States.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 1 times. Targeted ports: 42694. Country: Kazakhstan.
Observed 5 times. Targeted ports: 9160. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 56103. Country: Italy.
Observed 4 times. Targeted ports: 445. Country: China.
Observed 269 times. Targeted ports: 80, 1081, 1082, 1085, 3128, 3129, 4145, 4153, 6515, 6588, 7497, 7777, 8081, 8082, 8088, 8118, 8123, 8800, 8888, 8899, 9050, 9090, 9091, 9150, 9999, 10000. Country: Germany.
Observed 10 times. Targeted ports: 2000. Country: United Arab Emirates. Reputation: known attacker.
Observed 3 times. Targeted ports: 2222. Country: United Kingdom.
Observed 5 times. Targeted ports: 8443. Country: United Kingdom.
Observed 2 times. Targeted ports: 18443. Country: China.
Observed 10 times. Targeted ports: 3389. Country: China.
Observed 7 times. Targeted ports: 18443. Country: China.
Observed 7 times. Targeted ports: 18443. Country: China.
Observed 6 times. Targeted ports: 18443. Country: China.
Observed 6 times. Targeted ports: 51922. Country: Kenya.
Observed 1 times. Targeted ports: 23. Country: China.
Observed 1 times. Country: El Salvador.
Observed 3 times. Targeted ports: 8443. Country: United Kingdom.
Observed 10 times. Targeted ports: 443. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 1 times. Targeted ports: 4827. Country: Brazil.
Observed 8 times. Targeted ports: 8443. Country: France.
Observed 1 times. Targeted ports: 26985. Country: United States.
Observed 5 times. Targeted ports: 1093. Country: China.
Observed 5 times. Targeted ports: 23. Country: Poland.
Observed 7 times. Targeted ports: 23. Country: Argentina.
Observed 11 times. Targeted ports: 23. Country: China.
Observed 12 times. Targeted ports: 445. Country: India. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 8 times. Targeted ports: 8443. Country: France.
Observed 25 times. Targeted ports: 4782. Country: United States.
Observed 2 times. Targeted ports: 435. Country: United States. Reputation: known attacker.
Observed 1 times. Targeted ports: 5771. Country: United Arab Emirates.
Observed 5 times. Targeted ports: 445. Country: India.
Observed 1 times. Targeted ports: 4000. Country: France. Reputation: known attacker.
Observed 10 times. Targeted ports: 22, 23. Country: Russia.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 38877. Country: France.
Observed 1 times. Targeted ports: 33137. Country: Brazil.
Observed 10 times. Targeted ports: 22, 23. Country: United States.
Observed 2 times. Targeted ports: 514. Country: United States. Reputation: known attacker.
Observed 4 times. Targeted ports: 23. Country: South Africa.
Observed 5 times. Targeted ports: 22. Country: Chile.
Observed 13 times. Targeted ports: 58000. Country: Singapore. Reputation: known attacker.
Observed 1 times. Targeted ports: 25814. Country: Brazil.
Observed 5 times. Targeted ports: 18245. Country: United States.
Observed 13 times. Targeted ports: 4444. Country: United States.
Observed 1 times. Targeted ports: 7156. Country: Brazil.
Observed 5 times. Targeted ports: 8443. Country: United States.
Observed 7 times. Targeted ports: 3389. Country: South Africa. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 2 times. Targeted ports: 1521. Country: United States. Reputation: known attacker.
Observed 4 times. Targeted ports: 22. Country: Vietnam.
Observed 5 times. Targeted ports: 23. Country: Argentina.
Observed 2 times. Targeted ports: 8080. Country: China.
Observed 1 times. Targeted ports: 14583. Country: Brazil.
Observed 24 times. Targeted ports: 8000. Country: United States.
Observed 5 times. Targeted ports: 8443. Country: United States.
Observed 12 times. Targeted ports: 23. Country: Italy.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 4 times. Targeted ports: 22022. Country: Vietnam. Reputation: known attacker.
Observed 1 times. Targeted ports: 23. Country: Canada.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 2 times. Targeted ports: 8443. Country: United Kingdom.
Observed 11 times. Targeted ports: 3389. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 9 times. Targeted ports: 8010. Country: United States.
Observed 13 times. Targeted ports: 445. Country: Poland. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 8 times. Targeted ports: 3389. Country: China.
Observed 5 times. Targeted ports: 18002. Country: Singapore. Reputation: known attacker.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 8 times. Targeted ports: 8443. Country: Canada.
Observed 7 times. Targeted ports: 8629. Country: Mongolia.
Observed 7 times. Targeted ports: 23. Country: Jamaica.
Observed 1 times. Targeted ports: 12063. Country: Brazil.
Observed 803 times. Targeted ports: 21, 22, 80, 110, 143, 443, 445, 465, 587, 636, 990, 993, 995, 2083, 2087, 3000, 3306, 5000, 5432, 5671, 8000, 8008, 8080, 8081, 8443, 8880, 8883, 8888, 9000, 10000. Country: United States.
Observed 12 times. Targeted ports: 3389. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 48755. Country: Brazil. Reputation: known attacker.
Observed 1 times. Country: United Kingdom.
Observed 11 times. Targeted ports: 22. Country: China. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: user.
Observed 1 times. Targeted ports: 28842. Country: Vietnam.
Observed 5 times. Targeted ports: 8443. Country: United States.
Observed 22 times. Targeted ports: 7173. Country: United States.
Observed 2 times. Targeted ports: 5001. Country: China.
Observed 1 times. Targeted ports: 5001. Country: China.
Observed 1 times. Targeted ports: 5001. Country: China.
Observed 6 times. Targeted ports: 8089. Country: China.
Observed 6 times. Targeted ports: 8089. Country: China.
Observed 6 times. Targeted ports: 5001. Country: China.
Observed 7 times. Targeted ports: 8089. Country: China.