Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 507,059 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 6 times. Targeted ports: 5118. Country: United States. Reputation: bad reputation.
Observed 11 times. Targeted ports: 22. Country: United States. Reputation: web attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: sharing.
Observed 10 times. Targeted ports: 8000. Country: United Arab Emirates. Reputation: scan source.
Observed 8 times. Targeted ports: 1024. Country: Portugal. Reputation: bad reputation.
Observed 4 times. Targeted ports: 3151. Country: Türkiye. Reputation: bad reputation.
Observed 2 times. Targeted ports: 62224. Country: Russia.
Observed 5 times. Targeted ports: 21. Country: United States. Reputation: bad reputation.
Observed 2 times. Targeted ports: 23. Country: China.
Observed 8 times. Targeted ports: 2222. Country: United States. Reputation: web attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Unusual Port.
Observed 4 times. Targeted ports: 3556. Country: Belgium.
Observed 2 times. Targeted ports: 137. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 8008. Country: United States. Reputation: bad reputation.
Observed 30 times. Targeted ports: 80. Country: United States.
Observed 522 times. Targeted ports: 80, 443, 3000, 3128, 5001, 8000, 8006, 8081, 8082, 8083, 8443, 8888, 9000, 9443, 10000. Country: Lithuania. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data, SURICATA STREAM spurious retransmission.
Observed 4 times. Targeted ports: 8008. Country: United States. Reputation: bad reputation.
Observed 22 times. Targeted ports: 50050. Country: United States.
Observed 121 times. Targeted ports: 22049, 22050, 22055, 22056, 22057, 22058, 22059, 22060, 22063, 22065, 22066, 22067, 22069, 22071, 22072, 22073, 22075, 22077, 22078, 22079, 22080, 22081, 22082, 22083, 22089, 22092, 22094, 22095, 22096. Country: United Kingdom. Reputation: bad reputation.
Observed 2 times. Targeted ports: 23. Country: Belgium.
Observed 4 times. Targeted ports: 3210. Country: United States.
Observed 4 times. Targeted ports: 7443. Country: United States. Reputation: bad reputation.
Observed 123 times. Targeted ports: 53, 81, 111, 137, 1723, 2049, 2888, 3479, 4786, 5000, 7002, 7004, 7070, 9001, 9090, 11211, 20443, 22222, 27019, 45000, 49152, 51080. Country: United States. Reputation: bad reputation.
Observed 5 times. Targeted ports: 46198. Country: United Kingdom. Reputation: bad reputation.
Observed 15 times. Targeted ports: 5985. Country: United States. Reputation: bad reputation. Alert categories: Detection of a Network Scan. Signatures: ET SCAN Zmap User-Agent (Inbound).
Observed 25 times. Targeted ports: 4431. Country: Singapore.
Observed 4 times. Targeted ports: 8047. Country: United States. Reputation: bad reputation.
Observed 93 times. Targeted ports: 443. Country: Belgium.
Observed 9 times. Targeted ports: 443. Country: Belgium.
Observed 1 times. Targeted ports: 64878. Country: United States.
Observed 2 times. Targeted ports: 23. Country: Malaysia.
Observed 193 times. Targeted ports: 5552. Country: Belgium.
Observed 4 times. Targeted ports: 5269. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 5552. Country: Belgium.
Observed 10 times. Targeted ports: 445. Country: Indonesia.
Observed 4 times. Targeted ports: 3389. Country: Singapore.
Observed 11 times. Targeted ports: 10086. Country: United States.
Observed 26 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 3192 times. Targeted ports: 80. Country: United States. Reputation: bad reputation.
Observed 22 times. Targeted ports: 8048. Country: United States.
Observed 5 times. Targeted ports: 15310. Country: United States. Reputation: mail abuse.
Observed 9 times. Targeted ports: 3391. Country: United States. Reputation: bad reputation.
Observed 16 times. Targeted ports: 8089. Country: The Netherlands.
Observed 23 times. Targeted ports: 8096. Country: Malaysia. Reputation: bad reputation.
Observed 5 times. Targeted ports: 5985. Country: Saudi Arabia. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 2 times. Targeted ports: 23. Country: China.
Observed 13 times. Targeted ports: 33443. Country: United States.
Observed 19 times. Targeted ports: 9443. Country: Singapore. Reputation: bad reputation.
Observed 2 times. Targeted ports: 23. Country: Iran.
Observed 7 times. Targeted ports: 3389. Country: Germany.
Observed 4 times. Targeted ports: 6667. Country: United States. Reputation: bad reputation.
Observed 1 times. Country: United States. Reputation: mass scanner. Alert categories: Attempted Administrator Privilege Gain. Signatures: ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free.
Observed 1 times. Targeted ports: 389. Country: United States. Reputation: mass scanner.
Observed 5 times. Targeted ports: 3389. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 1433. Country: United States.
Observed 20 times. Targeted ports: 1111. Country: The Netherlands.
Observed 4 times. Targeted ports: 1433. Country: China.
Observed 4 times. Targeted ports: 11443. Country: United States. Reputation: scan source.
Observed 11 times. Targeted ports: 10029. Country: United States. Reputation: bad reputation.
Observed 36 times. Targeted ports: 3389, 3390. Country: United States. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with invalid timestamp.
Observed 1 times. Targeted ports: 23. Country: Uzbekistan. Reputation: service abuse.
Observed 20 times. Targeted ports: 8044. Country: United States.
Observed 5 times. Targeted ports: 6467. Country: Brazil. Reputation: scan source.
Observed 10 times. Targeted ports: 1234. Country: United States.
Observed 1 times. Targeted ports: 80. Country: Belgium.
Observed 26 times. Targeted ports: 12512. Country: Japan. Reputation: bad reputation.
Observed 102 times. Targeted ports: 389. Country: Belgium. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction, SURICATA Applayer Mismatch protocol both directions. Usernames: cn=luqkmljeqvsfitzlamny.
Observed 25 times. Targeted ports: 8582. Country: Germany. Reputation: bad reputation.
Observed 5 times. Targeted ports: 80. Country: Belgium.
Observed 11 times. Targeted ports: 80. Country: Belgium.
Observed 1 times. Targeted ports: 53. Country: Belgium.
Observed 23 times. Targeted ports: 22. Country: Belgium. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 1 times. Targeted ports: 123. Country: Belgium.
Observed 9 times. Targeted ports: 80. Country: United States. Alert categories: Misc activity. Signatures: GPL ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited.
Observed 16 times. Targeted ports: 22. Country: China. Reputation: service abuse. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA TCPv4 invalid checksum.
Observed 1 times. Targeted ports: 8080. Country: United States.
Observed 5 times. Targeted ports: 5905. Country: Vietnam. Reputation: bad reputation.
Observed 6 times. Targeted ports: 53. Country: Belgium.
Observed 5 times. Targeted ports: 53. Country: Belgium.
Observed 1 times. Targeted ports: 123. Country: Belgium.
Observed 6 times. Targeted ports: 28969. Country: United States. Reputation: scan source.
Observed 9 times. Targeted ports: 53. Country: Belgium.
Observed 4 times. Targeted ports: 9663. Country: South Korea.
Observed 6 times. Targeted ports: 49152. Country: China.
Observed 18 times. Targeted ports: 22. Country: Belgium. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 3 times. Targeted ports: 5678. Country: United States. Reputation: scan source.
Observed 1 times. Targeted ports: 548. Country: China. Reputation: bad reputation.
Observed 5 times. Targeted ports: 2095. Country: United States. Reputation: bad reputation.
Observed 2 times. Targeted ports: 23. Country: Brazil.
Observed 1 times. Targeted ports: 21. Country: Belgium.
Observed 12 times. Targeted ports: 12539. Country: Singapore. Reputation: bad reputation.
Observed 18 times. Targeted ports: 7001. Country: Malaysia. Reputation: bad reputation.
Observed 54 times. Targeted ports: 389. Country: Belgium. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction, SURICATA Applayer Mismatch protocol both directions, SURICATA TLS invalid record type. Usernames: cn=zfwbzkhaowslqbudkbvn.
Observed 8 times. Targeted ports: 389. Country: Belgium.
Observed 1 times. Targeted ports: 23. Country: Russia. Reputation: service abuse.
Observed 8 times. Targeted ports: 21. Country: Belgium.
Observed 1 times. Targeted ports: 32414. Country: Canada.
Observed 2 times. Targeted ports: 427. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 8530. Country: United States. Reputation: mass scanner.
Observed 4 times. Targeted ports: 20001. Country: United States. Reputation: mass scanner.
Observed 2 times. Targeted ports: 25. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 500. Country: United States. Reputation: mass scanner.