Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 507,088 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 3 times. Targeted ports: 10000. Country: United States. Reputation: scan source.
Observed 8 times. Targeted ports: 22, 23. Country: Russia.
Observed 2 times. Targeted ports: 161. Country: The Netherlands. Reputation: bad reputation.
Observed 2 times. Targeted ports: 22033. Country: United Kingdom.
Observed 415 times. Targeted ports: 21951, 21955, 21962, 21963, 21967, 21970, 21972, 21973, 21976, 21991. Country: United Kingdom.
Observed 429 times. Targeted ports: 21952, 21953, 21957, 21960, 21964, 21971, 21975, 21978, 21979, 21989. Country: United Kingdom.
Observed 170 times. Targeted ports: 21951, 21952, 21953, 21954, 21955, 21957, 21958, 21959, 21960, 21962, 21963, 21964, 21967, 21968, 21969, 21970, 21971, 21972, 21973, 21974, 21975, 21976, 21977, 21978, 21979, 21982, 21983, 21984, 21985, 21986, 21987, 21989, 21992, 21993, 21994, 21997, 21998. Country: United Kingdom.
Observed 69 times. Targeted ports: 22002, 22020. Country: United Kingdom.
Observed 571 times. Targeted ports: 22001, 22006, 22007, 22008, 22009, 22012, 22013, 22018, 22022, 22023, 22026, 22027, 22029, 22035, 22039, 22040, 22042, 22046. Country: United Kingdom.
Observed 36 times. Targeted ports: 22003. Country: United Kingdom.
Observed 35 times. Targeted ports: 22024. Country: United Kingdom.
Observed 36 times. Targeted ports: 22019. Country: United Kingdom.
Observed 66 times. Targeted ports: 22044, 22047. Country: United Kingdom.
Observed 39 times. Targeted ports: 22021. Country: United Kingdom.
Observed 195 times. Targeted ports: 22005, 22011, 22015, 22017, 22036, 22037. Country: United Kingdom.
Observed 4 times. Targeted ports: 4573. Country: United States. Reputation: mass scanner.
Observed 81 times. Targeted ports: 21999, 22002, 22004, 22010, 22014, 22016, 22020, 22021, 22024, 22030, 22033, 22034, 22044, 22045, 22046, 22047. Country: United Kingdom.
Observed 38 times. Targeted ports: 8080. Country: Singapore. Reputation: bad reputation.
Observed 24 times. Targeted ports: 8881. Country: United States.
Observed 8 times. Targeted ports: 50014. Country: Nigeria. Reputation: bad reputation.
Observed 2 times. Targeted ports: 56454. Country: The Netherlands.
Observed 13 times. Targeted ports: 80. Country: Hong Kong. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Request excessive header repetition.
Observed 1 times. Targeted ports: 403. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 23. Country: United States. Reputation: mass scanner.
Observed 10 times. Targeted ports: 445. Country: Vietnam.
Observed 5 times. Targeted ports: 10000. Country: United States. Reputation: bad reputation.
Observed 24 times. Targeted ports: 9443. Country: United States.
Observed 25 times. Targeted ports: 12153. Country: Germany. Reputation: bad reputation.
Observed 1 times. Targeted ports: 23. Country: South Korea. Reputation: service abuse.
Observed 25 times. Targeted ports: 445, 1433. Country: Thailand. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use. Usernames: sa.
Observed 48 times. Targeted ports: 3359. Country: United States.
Observed 13 times. Targeted ports: 2375. Country: United States. Reputation: bad reputation.
Observed 28 times. Targeted ports: 8864. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 23. Country: China.
Observed 1 times. Targeted ports: 9100. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 8080. Country: Indonesia.
Observed 1 times. Targeted ports: 500. Country: United States. Reputation: mass scanner.
Observed 1 times. Country: United States.
Observed 4 times. Targeted ports: 443. Country: China.
Observed 4 times. Targeted ports: 22. Country: Bulgaria. Reputation: bad reputation.
Observed 30 times. Targeted ports: 443. Country: United States. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 21 times. Targeted ports: 7777. Country: The Netherlands.
Observed 5 times. Targeted ports: 1433. Country: Panama. Reputation: attack source. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 2 times. Targeted ports: 88. Country: United States. Reputation: bad reputation.
Observed 5 times. Targeted ports: 3460. Country: South Korea. Reputation: bad reputation.
Observed 3 times. Targeted ports: 5080. Country: United States. Reputation: scan source.
Observed 1 times. Country: China.
Observed 4 times. Targeted ports: 5986. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 22. Country: China. Reputation: attack source. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA TCPv4 invalid checksum.
Observed 1 times. Targeted ports: 5083. Country: Australia. Reputation: bad reputation.
Observed 1 times. Targeted ports: 17298. Country: Singapore.
Observed 10 times. Targeted ports: 22. Country: Taiwan. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 4 times. Targeted ports: 3479. Country: United States. Reputation: bad reputation.
Observed 92 times. Targeted ports: 9202. Country: United States. Reputation: bad reputation.
Observed 39 times. Targeted ports: 9202. Country: United States. Reputation: bad reputation.
Observed 12 times. Targeted ports: 9202. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 123. Country: United States. Reputation: scan source.
Observed 37 times. Targeted ports: 9202. Country: United States.
Observed 5 times. Targeted ports: 12345. Country: India. Reputation: bad reputation.
Observed 6 times. Targeted ports: 32626. Country: United Kingdom. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 1 times. Targeted ports: 23. Country: China.
Observed 12 times. Targeted ports: 9300. Country: United States. Reputation: scan source.
Observed 24 times. Targeted ports: 8820. Country: Malaysia. Reputation: bad reputation.
Observed 16 times. Targeted ports: 2323. Country: United States. Reputation: bad reputation.
Observed 19 times. Targeted ports: 3333. Country: Canada.
Observed 1 times. Country: China.
Observed 42 times. Targeted ports: 55555. Country: Singapore. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP missing Host header.
Observed 1 times. Targeted ports: 3389. Country: United States.
Observed 4 times. Targeted ports: 20020. Country: United States. Reputation: scan source.
Observed 1 times. Country: United Kingdom.
Observed 4 times. Targeted ports: 22337. Country: The Netherlands.
Observed 6 times. Targeted ports: 50982. Country: United States. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 12 times. Targeted ports: 23. Country: Russia.
Observed 4 times. Targeted ports: 4333. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 5985. Country: Morocco.
Observed 4 times. Targeted ports: 1962. Country: United States. Reputation: bad reputation.
Observed 21 times. Targeted ports: 1177. Country: United Kingdom.
Observed 3 times. Targeted ports: 27018. Country: Japan. Reputation: bad reputation.
Observed 1 times. Country: Singapore.
Observed 681 times. Targeted ports: 21853, 21855, 21863, 21866, 21870, 21871, 21873, 21878, 21881, 21883, 21885, 21886, 21887, 21891, 21892, 21893, 21899. Country: United Kingdom.
Observed 571 times. Targeted ports: 21854, 21859, 21860, 21861, 21865, 21868, 21869, 21874, 21876, 21877, 21888, 21894, 21897, 21898. Country: United Kingdom.
Observed 200 times. Targeted ports: 21857, 21858, 21875, 21880, 21896. Country: United Kingdom.
Observed 7 times. Targeted ports: 5900. Country: Hong Kong. Reputation: scan source.
Observed 314 times. Targeted ports: 21862, 21872, 21879, 21882, 21889, 21890, 21895, 21900. Country: United Kingdom.
Observed 5 times. Targeted ports: 23. Country: China. Reputation: service abuse.
Observed 594 times. Targeted ports: 21909, 21910, 21911, 21918, 21921, 21926, 21927, 21929, 21930, 21933, 21937, 21940, 21945, 21949. Country: United Kingdom.
Observed 596 times. Targeted ports: 21905, 21912, 21913, 21915, 21917, 21923, 21925, 21928, 21931, 21932, 21939, 21941, 21943, 21946, 21947. Country: United Kingdom.
Observed 167 times. Targeted ports: 21902, 21907, 21934, 21938. Country: United Kingdom.
Observed 1 times. Country: United Kingdom.
Observed 4 times. Targeted ports: 37777. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 4 times. Targeted ports: 22. Country: Romania. Reputation: bad reputation.
Observed 2 times. Targeted ports: 505. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 11. Country: United States. Reputation: mass scanner.
Observed 16 times. Targeted ports: 21917, 21935, 21941, 21946. Country: United Kingdom. Reputation: attack source.
Observed 6 times. Targeted ports: 5900. Country: Hong Kong. Reputation: scan source.
Observed 24 times. Targeted ports: 445. Country: Vietnam. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 9580. Country: South Korea.
Observed 12 times. Targeted ports: 2222. Country: Hong Kong. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 3 times. Targeted ports: 8090. Country: United States. Reputation: mass scanner.