Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 473,066 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 7 times. Targeted ports: 18072. Country: China.
Observed 7 times. Targeted ports: 18072. Country: China. Reputation: known attacker.
Observed 7 times. Targeted ports: 8443. Country: Germany.
Observed 14 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 38 times. Targeted ports: 8443. Country: United States.
Observed 16 times. Targeted ports: 8443. Country: United States.
Observed 14 times. Targeted ports: 8443. Country: United States.
Observed 1 times. Targeted ports: 1434. Country: Belgium.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: Canada.
Observed 14 times. Targeted ports: 8443. Country: Germany.
Observed 15 times. Targeted ports: 8443. Country: Thailand.
Observed 16 times. Targeted ports: 8443. Country: Germany.
Observed 4 times. Targeted ports: 445. Country: Russia.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: France.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 5 times. Targeted ports: 23. Country: China.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 6 times. Targeted ports: 23. Country: Jordan.
Observed 7 times. Targeted ports: 8443. Country: France.
Observed 9 times. Targeted ports: 8443. Country: Thailand.
Observed 8 times. Targeted ports: 8443. Country: United States.
Observed 4 times. Targeted ports: 23. Country: Vietnam.
Observed 27 times. Targeted ports: 22. Country: China. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: root.
Observed 20 times. Targeted ports: 445. Country: India. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 15 times. Targeted ports: 8443. Country: Brazil.
Observed 10 times. Targeted ports: 80. Country: Cambodia. Reputation: known attacker.
Observed 16 times. Targeted ports: 8443. Country: Brazil.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 14 times. Targeted ports: 8443. Country: United States.
Observed 14 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 16 times. Targeted ports: 8443. Country: Germany.
Observed 15 times. Targeted ports: 8443. Country: Brazil.
Observed 15 times. Targeted ports: 8443. Country: Spain.
Observed 14 times. Targeted ports: 8443. Country: Thailand.
Observed 15 times. Targeted ports: 8443. Country: United Kingdom.
Observed 15 times. Targeted ports: 8443. Country: Brazil.
Observed 10 times. Targeted ports: 22, 23. Country: Pakistan.
Observed 15 times. Targeted ports: 8443. Country: Germany.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 52 times. Targeted ports: 8443. Country: United States.
Observed 14 times. Targeted ports: 8443. Country: France.
Observed 14 times. Targeted ports: 8443. Country: Brazil.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 2 times. Targeted ports: 8443. Country: Canada.
Observed 7 times. Targeted ports: 8443. Country: United States.
Observed 313 times. Targeted ports: 80, 88, 338, 444, 543, 770, 1399, 2017, 2023, 2203, 3001, 3006, 3302, 3360, 3394, 3899, 4389, 4469, 4489, 5000, 5001, 5024, 5055, 5500, 5555, 5679, 6547, 6656, 7295, 7485, 7575, 7822, 8007, 8099, 8156, 8400, 8453, 8520, 8991, 9090, 9390, 10390, 10403, 11000, 12122, 13301, 13389, 13398, 13980, 14801, 16384, 19311, 20080, 21010, 21212, 22318, 28050, 30318, 31425, 32110, 32165, 33034, 33389, 33392, 33893, 34535, 35080, 35971, 36333, 37895, 38551, 39865, 40100, 40404, 43729, 44044, 44568, 48484, 49006, 49028, 50501, 51234, 51844, 53387, 53389, 54322, 55055, 57179, 58394, 60006, 61224, 61388, 61781, 61793, 63456, 63542, 64857, 65000, 65001, 65005, 65055. Country: Seychelles. Reputation: known attacker.
Observed 15 times. Targeted ports: 8443. Country: Germany.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: Canada.
Observed 15 times. Targeted ports: 8443. Country: United Kingdom.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 14 times. Targeted ports: 8443. Country: France.
Observed 14 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: United Kingdom.
Observed 1 times. Targeted ports: 11211. Country: Singapore.
Observed 15 times. Targeted ports: 8443. Country: Thailand.
Observed 5 times. Targeted ports: 445. Country: Mongolia. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 13 times. Targeted ports: 8443. Country: Germany.
Observed 2 times. Targeted ports: 1000. Country: United States. Reputation: known attacker.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 15 times. Targeted ports: 8443. Country: Germany.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 7 times. Targeted ports: 8443. Country: United Kingdom.
Observed 15 times. Targeted ports: 2404. Country: United States.
Observed 8 times. Targeted ports: 8443. Country: United Kingdom.
Observed 15 times. Targeted ports: 8443. Country: Brazil.
Observed 2 times. Targeted ports: 8443. Country: Germany.
Observed 15 times. Targeted ports: 8443. Country: France.
Observed 4 times. Targeted ports: 443. Country: United States. Reputation: known attacker.
Observed 4 times. Targeted ports: 6007. Country: Singapore. Reputation: known attacker.
Observed 15 times. Targeted ports: 8443. Country: Brazil.
Observed 6 times. Targeted ports: 8443. Country: United States.
Observed 2 times. Targeted ports: 5060. Country: United States. Reputation: known attacker.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 13 times. Targeted ports: 22, 23. Country: United States.
Observed 16 times. Targeted ports: 8443. Country: Germany.
Observed 15 times. Targeted ports: 8443. Country: Brazil.
Observed 15 times. Targeted ports: 8443. Country: Brazil.
Observed 16 times. Targeted ports: 8443. Country: United States.
Observed 1 times. Targeted ports: 1433. Country: Brazil.
Observed 15 times. Targeted ports: 8443. Country: Germany.
Observed 7 times. Targeted ports: 8443. Country: United Kingdom.
Observed 19 times. Targeted ports: 445. Country: Ecuador. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 16 times. Targeted ports: 8443. Country: United States.
Observed 21 times. Targeted ports: 8443. Country: Brazil.
Observed 1 times. Targeted ports: 50895. Country: Brazil.
Observed 15 times. Targeted ports: 8443. Country: United States.
Observed 14 times. Targeted ports: 8443. Country: United Kingdom.
Observed 10 times. Targeted ports: 8443. Country: United States.
Observed 2 times. Targeted ports: 8443. Country: United States.
Observed 52 times. Targeted ports: 8443. Country: Germany.
Observed 6 times. Targeted ports: 8443. Country: France.
Observed 17 times. Targeted ports: 3341. Country: United States. Reputation: known attacker.
Observed 15 times. Targeted ports: 8443. Country: United States.