Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 507,750 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 87 times. Targeted ports: 20431, 20436, 20437, 20441, 20442, 20445, 20447, 20448, 20450, 20451, 20453, 20454, 20456, 20458, 20460, 20464, 20465, 20467, 20472, 20475, 20478. Country: United Kingdom.
Observed 6 times. Targeted ports: 2222. Country: China. Reputation: bad reputation.
Observed 460 times. Targeted ports: 20388, 20390, 20397, 20399, 20401, 20403, 20404, 20406, 20410, 20420, 20422, 20423. Country: United Kingdom.
Observed 357 times. Targeted ports: 20382, 20385, 20392, 20393, 20395, 20396, 20415, 20417, 20424. Country: United Kingdom.
Observed 12 times. Targeted ports: 22. Country: Japan. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: liu.
Observed 4 times. Targeted ports: 9263. Country: United States. Reputation: bad reputation.
Observed 815 times. Targeted ports: 20334, 20335, 20336, 20337, 20341, 20345, 20347, 20349, 20352, 20353, 20358, 20359, 20360, 20364, 20365, 20367, 20368, 20370, 20371, 20374, 20377, 20380. Country: United Kingdom.
Observed 13 times. Targeted ports: 80. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Request excessive header repetition.
Observed 7 times. Targeted ports: 5555. Country: China.
Observed 13 times. Targeted ports: 20354, 20361, 20374. Country: United Kingdom.
Observed 11 times. Targeted ports: 22. Country: India. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: .bottomlogo { height.
Observed 1 times. Targeted ports: 8080. Country: The Netherlands.
Observed 11 times. Targeted ports: 22. Country: Russia. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: weizhishuai.
Observed 5 times. Targeted ports: 22. Country: Germany.
Observed 4 times. Targeted ports: 6565. Country: China.
Observed 12 times. Targeted ports: 5050. Country: United States.
Observed 4 times. Targeted ports: 7000. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 1900. Country: United States. Reputation: bad reputation.
Observed 5 times. Targeted ports: 23. Country: Taiwan.
Observed 6 times. Targeted ports: 5039. Country: United Kingdom. Reputation: bad reputation. Alert categories: Misc activity. Signatures: GPL ICMP Destination Unreachable Communication Administratively Prohibited.
Observed 1 times. Targeted ports: 40894. Country: Germany.
Observed 1 times. Targeted ports: 30301. Country: China. Reputation: service abuse.
Observed 24 times. Targeted ports: 8082. Country: Singapore. Reputation: bad reputation.
Observed 1 times. Country: China.
Observed 4 times. Targeted ports: 23. Country: China.
Observed 5 times. Targeted ports: 9527. Country: United States. Reputation: bad reputation.
Observed 5 times. Targeted ports: 8098. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 1433. Country: India. Reputation: bad reputation.
Observed 25 times. Targeted ports: 445. Country: Brazil. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Country: United States.
Observed 4 times. Targeted ports: 1433. Country: Iran.
Observed 3 times. Targeted ports: 9000. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 11288. Country: Belgium.
Observed 2 times. Targeted ports: 22. Country: Russia. Reputation: ssh abuse.
Observed 4 times. Targeted ports: 6568. Country: United States.
Observed 27 times. Targeted ports: 6601. Country: Malaysia. Reputation: bad reputation.
Observed 312 times. Targeted ports: 22. Country: Tunisia. Reputation: bad reputation. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 1 times. Country: Germany.
Observed 2 times. Targeted ports: 25. Country: Switzerland.
Observed 4 times. Targeted ports: 8009. Country: United States. Reputation: bad reputation.
Observed 413 times. Targeted ports: 3000. Country: United States. Reputation: ssh abuse.
Observed 3 times. Targeted ports: 443. Country: Canada.
Observed 299 times. Targeted ports: 8443. Country: United States. Reputation: bot activity.
Observed 471 times. Targeted ports: 8888. Country: United States. Reputation: ssh abuse.
Observed 5 times. Targeted ports: 15061. Country: United States.
Observed 17 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 3 times. Targeted ports: 5903. Country: United States. Reputation: mass scanner.
Observed 19 times. Targeted ports: 445. Country: Sri Lanka. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 1 times. Targeted ports: 40580. Country: Mexico. Reputation: bad reputation.
Observed 3 times. Targeted ports: 8888. Country: Singapore.
Observed 1 times. Country: Brazil.
Observed 4 times. Targeted ports: 8333. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 4505. Country: Taiwan.
Observed 1 times. Targeted ports: 23. Country: France.
Observed 13 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 498. Country: United States. Reputation: scan source.
Observed 6 times. Targeted ports: 3306. Country: Belgium. Reputation: service abuse. Usernames: root.
Observed 6 times. Targeted ports: 445. Country: Egypt.
Observed 2 times. Targeted ports: 113. Country: United States.
Observed 4 times. Targeted ports: 15124. Country: Belgium.
Observed 5 times. Targeted ports: 6379. Country: China. Reputation: ssh abuse.
Observed 26 times. Targeted ports: 445. Country: Taiwan. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 8123. Country: Canada.
Observed 1 times. Country: China.
Observed 7 times. Targeted ports: 23. Country: Pakistan.
Observed 6 times. Targeted ports: 8500. Country: China.
Observed 6 times. Targeted ports: 8500. Country: China.
Observed 1 times. Targeted ports: 53960. Country: Indonesia. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM RST recv but no session.
Observed 6 times. Targeted ports: 8500. Country: China.
Observed 7 times. Targeted ports: 8500. Country: China.
Observed 8 times. Targeted ports: 8500. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Request excessive header repetition.
Observed 6 times. Targeted ports: 8500. Country: China.
Observed 7 times. Targeted ports: 8500. Country: China.
Observed 4 times. Targeted ports: 8008. Country: United States. Reputation: bad reputation.
Observed 48 times. Targeted ports: 20286, 20287, 20289, 20294, 20301, 20303, 20304, 20306, 20316, 20317, 20324, 20331. Country: United Kingdom.
Observed 52 times. Targeted ports: 20291, 20295, 20298, 20305, 20308, 20312, 20319, 20320, 20321, 20322, 20329, 20330, 20332. Country: United Kingdom.
Observed 48 times. Targeted ports: 20293, 20296, 20297, 20300, 20302, 20313, 20315, 20326, 20327, 20328. Country: United Kingdom.
Observed 16 times. Targeted ports: 20284, 20307, 20311, 20318. Country: United Kingdom.
Observed 5 times. Targeted ports: 7000. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 20257. Country: United States. Reputation: scan source.
Observed 5 times. Targeted ports: 22. Country: Belgium.
Observed 1 times. Country: Hong Kong.
Observed 1 times. Targeted ports: 10161. Country: United States. Reputation: mass scanner.
Observed 4 times. Targeted ports: 7077. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 990. Country: Belgium.
Observed 13 times. Targeted ports: 8861. Country: Germany. Reputation: bad reputation.
Observed 4 times. Targeted ports: 4444. Country: Belgium.
Observed 17 times. Targeted ports: 445. Country: Iran. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Country: China.
Observed 45 times. Targeted ports: 25324. Country: United States. Reputation: scan source.
Observed 27 times. Targeted ports: 445. Country: Syria. Alert categories: Generic Protocol Command Decode, Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use, SURICATA STREAM spurious retransmission.
Observed 5 times. Targeted ports: 9160. Country: United States. Reputation: bad reputation.
Observed 12 times. Targeted ports: 8188. Country: Germany. Reputation: bad reputation.
Observed 1 times. Targeted ports: 5432. Country: United Kingdom. Reputation: bad reputation.
Observed 3 times. Targeted ports: 8088. Country: United States. Reputation: scan source.
Observed 8 times. Targeted ports: 8808. Country: Belgium.
Observed 1 times. Targeted ports: 137. Country: United Kingdom.
Observed 17 times. Targeted ports: 5006. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 29999. Country: China. Reputation: bad reputation.
Observed 1 times. Country: China.