Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 507,636 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 16 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA TCPv4 invalid checksum.
Observed 238 times. Targeted ports: 20483, 20498, 20502, 20513, 20519, 20524. Country: United Kingdom.
Observed 821 times. Targeted ports: 20484, 20486, 20487, 20488, 20489, 20490, 20494, 20496, 20503, 20506, 20507, 20508, 20509, 20514, 20515, 20517, 20521, 20523, 20525, 20526, 20528. Country: United Kingdom.
Observed 42 times. Targeted ports: 20485. Country: United Kingdom.
Observed 121 times. Targeted ports: 20493, 20495, 20499. Country: United Kingdom.
Observed 326 times. Targeted ports: 20480, 20482, 20492, 20500, 20504, 20510, 20516, 20527. Country: United Kingdom.
Observed 7 times. Targeted ports: 11434. Country: Australia.
Observed 2 times. Targeted ports: 102. Country: United States. Reputation: bad reputation.
Observed 120 times. Targeted ports: 20534, 20535, 20537, 20538, 20539, 20541, 20543, 20544, 20545, 20546, 20548, 20553, 20560, 20561, 20563, 20565, 20567, 20568, 20569, 20571, 20572, 20574, 20576, 20577. Country: United Kingdom.
Observed 19 times. Targeted ports: 8888. Country: United States. Reputation: bad reputation.
Observed 189 times. Targeted ports: 20480, 20481, 20482, 20483, 20484, 20485, 20486, 20487, 20488, 20489, 20490, 20492, 20493, 20494, 20495, 20496, 20497, 20498, 20500, 20502, 20503, 20504, 20505, 20506, 20507, 20508, 20509, 20510, 20512, 20513, 20514, 20515, 20516, 20517, 20518, 20519, 20520, 20521, 20523, 20524, 20525, 20526, 20527, 20528. Country: United Kingdom.
Observed 2 times. Targeted ports: 21. Country: United Kingdom.
Observed 188 times. Targeted ports: 20530, 20531, 20532, 20533, 20534, 20535, 20537, 20538, 20539, 20541, 20542, 20543, 20544, 20545, 20546, 20548, 20549, 20550, 20551, 20552, 20553, 20554, 20555, 20556, 20557, 20558, 20559, 20560, 20561, 20562, 20563, 20565, 20566, 20567, 20568, 20569, 20570, 20571, 20572, 20573, 20574, 20575, 20576, 20577. Country: United Kingdom.
Observed 5 times. Targeted ports: 445. Country: Italy.
Observed 197 times. Targeted ports: 44443. Country: Belgium.
Observed 190 times. Targeted ports: 6009. Country: Belgium.
Observed 1 times. Targeted ports: 15061. Country: United States.
Observed 8 times. Targeted ports: 6009. Country: Belgium.
Observed 5 times. Targeted ports: 44443. Country: Belgium.
Observed 5 times. Targeted ports: 3389. Country: United States. Reputation: bad reputation.
Observed 16 times. Targeted ports: 80. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Mismatch protocol both directions.
Observed 11 times. Targeted ports: 5555. Country: China.
Observed 6 times. Targeted ports: 3128. Country: China.
Observed 7 times. Targeted ports: 3128. Country: China.
Observed 4 times. Targeted ports: 445. Country: Hong Kong. Reputation: bad reputation.
Observed 8 times. Targeted ports: 22. Country: Seychelles. Reputation: ssh abuse.
Observed 4 times. Targeted ports: 22. Country: Bulgaria. Reputation: ssh abuse.
Observed 85 times. Targeted ports: 443. Country: Germany.
Observed 4 times. Targeted ports: 16005. Country: United States. Reputation: mail abuse.
Observed 46 times. Targeted ports: 25650. Country: United States. Reputation: scan source. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM ESTABLISHED SYN resend with different seq.
Observed 13 times. Targeted ports: 80. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Request excessive header repetition.
Observed 24 times. Targeted ports: 80. Country: Hong Kong. Reputation: bad reputation.
Observed 9 times. Targeted ports: 445. Country: Belgium.
Observed 2 times. Targeted ports: 1433. Country: China.
Observed 25 times. Targeted ports: 445. Country: Nigeria. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 3389. Country: The Netherlands. Reputation: scan source.
Observed 6 times. Targeted ports: 22222. Country: France. Reputation: ssh abuse.
Observed 4 times. Targeted ports: 22. Country: Seychelles. Reputation: bad reputation.
Observed 1 times. Targeted ports: 52562. Country: Canada. Reputation: attack source.
Observed 42 times. Targeted ports: 443. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 5 times. Targeted ports: 8171. Country: United States. Reputation: bad reputation.
Observed 11 times. Targeted ports: 22, 23. Country: France. Reputation: service abuse.
Observed 4 times. Targeted ports: 2052. Country: Nigeria. Reputation: bad reputation.
Observed 1 times. Targeted ports: 11278. Country: China.
Observed 1 times. Targeted ports: 8080. Country: Türkiye. Reputation: bad reputation.
Observed 13 times. Targeted ports: 8888, 31337. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction.
Observed 26 times. Targeted ports: 445. Country: Pakistan. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 5501, 9422. Country: United States. Reputation: bad reputation.
Observed 37 times. Targeted ports: 5984. Country: United States.
Observed 4 times. Targeted ports: 16005. Country: Germany. Reputation: bad reputation.
Observed 8 times. Targeted ports: 22, 23. Country: Chile.
Observed 1 times. Targeted ports: 1993. Country: Uruguay.
Observed 1 times. Targeted ports: 53. Country: The Netherlands.
Observed 25 times. Targeted ports: 16000. Country: Belgium.
Observed 1 times. Targeted ports: 21. Country: Belgium.
Observed 9 times. Targeted ports: 3389. Country: Türkiye. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 5 times. Targeted ports: 23. Country: Thailand.
Observed 1 times. Country: United States.
Observed 8 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA TCPv4 invalid checksum.
Observed 11 times. Targeted ports: 22. Country: United States. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: test5.
Observed 43 times. Targeted ports: 3355. Country: United States. Reputation: bad reputation.
Observed 7 times. Targeted ports: 1400. Country: United States.
Observed 4 times. Targeted ports: 1400. Country: United States. Reputation: mass scanner.
Observed 4 times. Targeted ports: 23. Country: Canada. Reputation: ssh abuse.
Observed 2 times. Targeted ports: 222. Country: United States. Reputation: bad reputation.
Observed 2 times. Targeted ports: 49158. Country: China.
Observed 19 times. Targeted ports: 23. Country: Pakistan.
Observed 21 times. Targeted ports: 9191. Country: United States.
Observed 7 times. Targeted ports: 3389. Country: Indonesia. Reputation: bad reputation.
Observed 1 times. Targeted ports: 1433. Country: China. Reputation: bad reputation.
Observed 6 times. Targeted ports: 49158. Country: China.
Observed 5 times. Targeted ports: 49158. Country: China.
Observed 6 times. Targeted ports: 49158. Country: China.
Observed 6 times. Targeted ports: 49158. Country: China.
Observed 2 times. Targeted ports: 22. Country: Türkiye. Reputation: web attacker.
Observed 4 times. Targeted ports: 1883. Country: United Arab Emirates.
Observed 1 times. Country: United States.
Observed 11 times. Targeted ports: 22. Country: India. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: student.
Observed 1 times. Country: United States.
Observed 2 times. Targeted ports: 5060. Country: United States.
Observed 4 times. Targeted ports: 49155. Country: Thailand. Reputation: bad reputation.
Observed 5 times. Targeted ports: 25471. Country: United States. Reputation: scan source. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM ESTABLISHED SYN resend with different seq.
Observed 1 times. Country: United States.
Observed 15 times. Targeted ports: 23. Country: Brazil.
Observed 5 times. Targeted ports: 80. Country: Switzerland.
Observed 1 times. Targeted ports: 389. Country: Belgium.
Observed 2 times. Targeted ports: 1433. Country: China.
Observed 17 times. Targeted ports: 20000. Country: Germany.
Observed 10 times. Targeted ports: 22. Country: Indonesia. Reputation: bad reputation. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 23 times. Targeted ports: 60000. Country: Germany. Reputation: bad reputation.
Observed 11 times. Targeted ports: 12123. Country: Germany. Reputation: bad reputation.
Observed 1 times. Targeted ports: 9080. Country: United States. Reputation: bad reputation.
Observed 357 times. Targeted ports: 20442, 20448, 20453, 20456, 20458, 20465, 20467, 20468, 20478. Country: United Kingdom.
Observed 535 times. Targeted ports: 20433, 20435, 20437, 20438, 20440, 20444, 20445, 20446, 20449, 20452, 20459, 20463, 20470, 20471. Country: United Kingdom.
Observed 122 times. Targeted ports: 20450, 20472, 20475. Country: United Kingdom.
Observed 10 times. Targeted ports: 22. Country: Vietnam. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 1 times. Targeted ports: 5060. Country: United States. Reputation: bad reputation.
Observed 12 times. Targeted ports: 23. Country: South Korea.
Observed 4 times. Targeted ports: 1723. Country: United States. Reputation: bad reputation.
Observed 13 times. Targeted ports: 22. Country: India. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: zhaojia.