Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 507,413 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 6 times. Targeted ports: 28658. Country: United States. Reputation: scan source. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM ESTABLISHED SYN resend with different seq.
Observed 4 times. Targeted ports: 8291. Country: United States. Reputation: scan source.
Observed 33 times. Targeted ports: 5222. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 1433. Country: India.
Observed 62 times. Targeted ports: 27019. Country: United States.
Observed 11 times. Targeted ports: 23. Country: South Korea. Reputation: bad reputation.
Observed 5 times. Targeted ports: 53. Country: China.
Observed 1 times. Targeted ports: 28601. Country: United States. Reputation: scan source.
Observed 21 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA TCPv4 invalid checksum. Usernames: root.
Observed 5 times. Targeted ports: 60023. Country: United States. Reputation: bad reputation.
Observed 13 times. Targeted ports: 3389, 5900. Country: Argentina. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 4 times. Targeted ports: 9392. Country: United States. Reputation: bad reputation.
Observed 31 times. Targeted ports: 3397, 23391, 43394, 43399, 53398. Country: India.
Observed 4 times. Targeted ports: 1024. Country: United States. Reputation: bad reputation.
Observed 2053 times. Targeted ports: 21068, 21069, 21070, 21071, 21072, 21073, 21074, 21075, 21076, 21077, 21078, 21079, 21080, 21082, 21083, 21085, 21086, 21087, 21089, 21090, 21091, 21092, 21093, 21094, 21096, 21097, 21098, 21099, 21100, 21101, 21102, 21103, 21105, 21106, 21107, 21108, 21109, 21110, 21111, 21112, 21113, 21114, 21115, 21116. Country: United Kingdom.
Observed 4 times. Targeted ports: 443. Country: Brazil.
Observed 8 times. Targeted ports: 1433. Country: Pakistan.
Observed 1606 times. Targeted ports: 21117, 21118, 21120, 21121, 21122, 21123, 21124, 21125, 21126, 21127, 21128, 21129, 21130, 21131, 21132, 21133, 21134, 21135, 21136, 21137, 21138, 21139, 21140, 21142, 21143, 21144, 21145, 21146, 21147, 21148, 21149, 21150, 21151, 21152, 21153, 21154, 21156, 21157, 21158, 21159, 21160, 21161, 21162, 21163, 21164, 21165. Country: United Kingdom.
Observed 48 times. Targeted ports: 21124, 21126, 21127, 21130, 21131, 21133, 21142, 21144, 21153, 21162, 21163. Country: United Kingdom.
Observed 11 times. Targeted ports: 23. Country: South Korea. Reputation: bad reputation.
Observed 24 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Country: Croatia.
Observed 28 times. Targeted ports: 23. Country: Pakistan.
Observed 7 times. Targeted ports: 11434. Country: Russia.
Observed 27 times. Targeted ports: 10443. Country: Hong Kong. Reputation: service abuse.
Observed 7 times. Targeted ports: 23. Country: China. Reputation: ssh abuse.
Observed 4 times. Targeted ports: 12321. Country: Germany. Reputation: bad reputation.
Observed 4 times. Targeted ports: 4321. Country: United States.
Observed 8 times. Targeted ports: 23. Country: Brazil.
Observed 2 times. Targeted ports: 21. Country: China.
Observed 2 times. Targeted ports: 21. Country: China. Reputation: bad reputation.
Observed 5 times. Targeted ports: 21. Country: China.
Observed 2 times. Targeted ports: 21. Country: China.
Observed 2 times. Targeted ports: 21. Country: China.
Observed 2 times. Targeted ports: 21. Country: China.
Observed 4 times. Targeted ports: 443. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 3000. Country: Portugal. Reputation: scan source.
Observed 6 times. Targeted ports: 10127. Country: China.
Observed 8 times. Targeted ports: 10127. Country: China. Reputation: bad reputation.
Observed 5 times. Targeted ports: 10127. Country: China.
Observed 75 times. Targeted ports: 9443. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 11742. Country: United States. Reputation: bad reputation.
Observed 11 times. Targeted ports: 22. Country: United States. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: odoo.
Observed 10 times. Targeted ports: 22. Country: France. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 34 times. Targeted ports: 4443. Country: Hong Kong. Reputation: service abuse.
Observed 12 times. Targeted ports: 23. Country: South Korea. Reputation: service abuse.
Observed 11 times. Targeted ports: 22. Country: United States. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: dockeruser.
Observed 2 times. Targeted ports: 25. Country: Iran. Reputation: mail abuse. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 4 times. Targeted ports: 8023. Country: United States.
Observed 4 times. Targeted ports: 1723. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 22. Country: France.
Observed 6 times. Targeted ports: 445. Country: Mexico.
Observed 6 times. Targeted ports: 23. Country: Azerbaijan.
Observed 5 times. Targeted ports: 34425. Country: United Kingdom. Reputation: bad reputation.
Observed 5 times. Targeted ports: 22. Country: Bulgaria. Reputation: ssh abuse.
Observed 5 times. Targeted ports: 23389. Country: United States. Reputation: scan source.
Observed 2 times. Targeted ports: 5060. Country: China. Reputation: bad reputation.
Observed 2 times. Targeted ports: 5060. Country: China.
Observed 2 times. Targeted ports: 5060. Country: China.
Observed 2 times. Targeted ports: 5060. Country: China.
Observed 2 times. Targeted ports: 5060. Country: China. Reputation: bad reputation.
Observed 2 times. Targeted ports: 5060. Country: China.
Observed 2 times. Targeted ports: 2222. Country: Egypt.
Observed 5 times. Targeted ports: 8443. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 19999. Country: United Kingdom. Reputation: bad reputation.
Observed 11 times. Targeted ports: 22. Country: India. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: infa.
Observed 4 times. Targeted ports: 8123. Country: United States. Reputation: bad reputation.
Observed 13 times. Targeted ports: 8088. Country: United States.
Observed 15 times. Targeted ports: 443. Country: The Netherlands.
Observed 4 times. Targeted ports: 3333. Country: United States. Reputation: bad reputation.
Observed 2 times. Targeted ports: 4931, 61066. Country: United Kingdom.
Observed 1 times. Targeted ports: 465. Country: United States. Reputation: bad reputation.
Observed 33 times. Targeted ports: 10801. Country: United States.
Observed 1 times. Targeted ports: 27015. Country: Taiwan. Reputation: bad reputation.
Observed 4 times. Targeted ports: 3000. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 1788. Country: United States. Reputation: ssh abuse.
Observed 5 times. Targeted ports: 8194. Country: Hong Kong. Reputation: bad reputation.
Observed 6 times. Targeted ports: 28080. Country: China.
Observed 7 times. Targeted ports: 28080. Country: China.
Observed 7 times. Targeted ports: 28080. Country: China.
Observed 5 times. Targeted ports: 28080. Country: China. Reputation: bad reputation.
Observed 7 times. Targeted ports: 28080. Country: China.
Observed 4 times. Targeted ports: 10801. Country: United States. Reputation: scan source.
Observed 1172 times. Targeted ports: 20971, 20972, 20973, 20977, 20978, 20980, 20984, 20985, 20987, 20989, 20990, 20992, 20993, 20996, 20997, 20998, 20999, 21003, 21004, 21006, 21007, 21008, 21009, 21011, 21015, 21016, 21018. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 540 times. Targeted ports: 20975, 20976, 20981, 20982, 20983, 20988, 20991, 21000, 21002, 21005, 21013, 21014, 21017. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction.
Observed 23 times. Targeted ports: 8381. Country: Germany. Reputation: bad reputation.
Observed 10 times. Targeted ports: 12111. Country: Singapore. Reputation: bad reputation.
Observed 8 times. Targeted ports: 23. Country: Russia.
Observed 6 times. Targeted ports: 5985. Country: Mexico.
Observed 1 times. Targeted ports: 5038. Country: Canada.
Observed 4 times. Targeted ports: 22. Country: Hong Kong. Reputation: bad reputation.
Observed 267 times. Targeted ports: 21020, 21039, 21040, 21043, 21059, 21064, 21066. Country: United Kingdom.
Observed 127 times. Targeted ports: 21019, 21056, 21057. Country: United Kingdom.
Observed 426 times. Targeted ports: 21025, 21028, 21030, 21031, 21033, 21036, 21048, 21050, 21052, 21054, 21063. Country: United Kingdom.
Observed 162 times. Targeted ports: 21026, 21042, 21055, 21060. Country: United Kingdom.
Observed 42 times. Targeted ports: 21034. Country: United Kingdom.
Observed 43 times. Targeted ports: 21045. Country: United Kingdom.
Observed 155 times. Targeted ports: 21024, 21046, 21047, 21049. Country: United Kingdom. Reputation: attack source.
Observed 300 times. Targeted ports: 21023, 21027, 21029, 21041, 21058, 21061, 21062, 21065. Country: United Kingdom.
Observed 58 times. Targeted ports: 20974, 20986, 20989, 20990, 20996, 20998, 20999, 21004, 21006, 21007, 21008, 21011, 21016, 21018. Country: United Kingdom.