Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 506,985 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 2 times. Targeted ports: 992. Country: China. Reputation: bad reputation.
Observed 5 times. Targeted ports: 4650. Country: United States. Reputation: bad reputation.
Observed 2 times. Targeted ports: 587. Country: United States.
Observed 2 times. Targeted ports: 2018. Country: Portugal. Reputation: scan source.
Observed 3 times. Targeted ports: 4444. Country: United States. Reputation: mass scanner.
Observed 2 times. Targeted ports: 8080. Country: United States. Reputation: bad reputation.
Observed 3 times. Targeted ports: 2018. Country: Portugal. Reputation: scan source.
Observed 2 times. Targeted ports: 23. Country: Türkiye.
Observed 401 times. Targeted ports: 22244, 22245, 22247, 22260, 22261, 22264, 22267, 22273, 22276, 22277, 22278, 22287. Country: United Kingdom.
Observed 2 times. Targeted ports: 23. Country: Brazil.
Observed 3 times. Targeted ports: 50099. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 23. Country: China. Reputation: bad reputation.
Observed 3 times. Targeted ports: 6025. Country: United States. Reputation: scan source.
Observed 25 times. Targeted ports: 3556. Country: Belgium.
Observed 2 times. Targeted ports: 8080. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 443. Country: China.
Observed 4 times. Targeted ports: 8200. Country: United States. Reputation: bad reputation.
Observed 135 times. Targeted ports: 22244, 22245, 22247, 22248, 22249, 22250, 22252, 22254, 22255, 22256, 22257, 22259, 22260, 22261, 22262, 22264, 22265, 22267, 22269, 22271, 22272, 22273, 22276, 22277, 22278, 22279, 22280, 22284, 22285, 22286, 22287, 22288. Country: United Kingdom.
Observed 14 times. Targeted ports: 80. Country: United States. Alert categories: Detection of a Network Scan. Signatures: ET SCAN Zmap User-Agent (Inbound).
Observed 5 times. Targeted ports: 11410. Country: United Kingdom. Reputation: bad reputation.
Observed 21 times. Targeted ports: 8040. Country: United States.
Observed 7 times. Targeted ports: 22. Country: South Africa. Reputation: ssh abuse.
Observed 4 times. Targeted ports: 5555. Country: Hong Kong.
Observed 14 times. Targeted ports: 54321. Country: China.
Observed 2 times. Targeted ports: 23. Country: Georgia.
Observed 6 times. Targeted ports: 22. Country: China.
Observed 77 times. Targeted ports: 3388. Country: United States. Reputation: attack source.
Observed 5 times. Targeted ports: 10001. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 6565. Country: China.
Observed 3 times. Targeted ports: 6565. Country: China.
Observed 5 times. Targeted ports: 6565. Country: China.
Observed 5 times. Targeted ports: 2376. Country: United States. Reputation: bad reputation.
Observed 15 times. Targeted ports: 3388. Country: Canada.
Observed 1 times. Targeted ports: 523. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 587. Country: United Kingdom. Reputation: bad reputation.
Observed 6 times. Targeted ports: 8651. Country: United States. Reputation: scan source.
Observed 18 times. Targeted ports: 50005. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 137. Country: United Kingdom.
Observed 43 times. Targeted ports: 4433. Country: United States.
Observed 673 times. Targeted ports: 22098, 22100, 22102, 22105, 22109, 22111, 22120, 22121, 22123, 22127, 22129, 22136, 22137, 22140, 22142, 22143, 22145. Country: United Kingdom.
Observed 517 times. Targeted ports: 22099, 22101, 22107, 22108, 22110, 22116, 22119, 22124, 22126, 22130, 22135, 22139, 22144. Country: United Kingdom.
Observed 590 times. Targeted ports: 22103, 22106, 22112, 22114, 22115, 22117, 22118, 22122, 22128, 22131, 22132, 22133, 22134, 22138, 22141. Country: United Kingdom.
Observed 43 times. Targeted ports: 22104. Country: United Kingdom.
Observed 145 times. Targeted ports: 22097, 22098, 22099, 22101, 22102, 22103, 22106, 22107, 22108, 22109, 22111, 22112, 22113, 22114, 22115, 22116, 22117, 22118, 22119, 22120, 22122, 22125, 22127, 22128, 22132, 22133, 22134, 22136, 22137, 22138, 22139, 22140, 22141, 22143, 22145. Country: United Kingdom. Reputation: attack source.
Observed 8 times. Targeted ports: 8268. Country: Belgium.
Observed 5 times. Targeted ports: 9443. Country: United States.
Observed 6 times. Targeted ports: 5222. Country: United States.
Observed 1 times. Targeted ports: 1521. Country: United States.
Observed 1 times. Targeted ports: 123. Country: United States.
Observed 2 times. Targeted ports: 25. Country: Belgium.
Observed 5 times. Targeted ports: 1389. Country: United States. Reputation: bad reputation.
Observed 2 times. Targeted ports: 23. Country: China.
Observed 4 times. Targeted ports: 27017. Country: Belgium.
Observed 9 times. Targeted ports: 22. Country: Bolivia. Reputation: attack source. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 8 times. Targeted ports: 3389. Country: United States.
Observed 26 times. Targeted ports: 445. Country: Russia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 70 times. Targeted ports: 1234. Country: Germany. Reputation: service abuse. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Detect protocol only one direction.
Observed 11 times. Targeted ports: 22. Country: United States. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: adminuser.
Observed 8 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA TCPv4 invalid checksum.
Observed 14 times. Targeted ports: 12528. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 7547. Country: United States. Alert categories: Detection of a Network Scan. Signatures: ET SCAN Zmap User-Agent (Inbound).
Observed 7 times. Targeted ports: 5555. Country: Taiwan.
Observed 3 times. Targeted ports: 9643. Country: United States. Reputation: mass scanner.
Observed 5 times. Targeted ports: 25565. Country: The Netherlands.
Observed 2 times. Targeted ports: 995. Country: United States.
Observed 2 times. Targeted ports: 888. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 2375. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 2222. Country: China.
Observed 6 times. Targeted ports: 8882. Country: China. Reputation: bad reputation.
Observed 6 times. Targeted ports: 8882. Country: China.
Observed 6 times. Targeted ports: 8882. Country: China.
Observed 8 times. Targeted ports: 8882. Country: China.
Observed 4 times. Targeted ports: 8140. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 1. Country: United States. Reputation: bad reputation.
Observed 20 times. Targeted ports: 7654. Country: Germany.
Observed 3 times. Targeted ports: 6161. Country: United States. Reputation: mass scanner.
Observed 10 times. Targeted ports: 7474. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 2223. Country: China.
Observed 6 times. Targeted ports: 2223. Country: China. Reputation: bad reputation.
Observed 7 times. Targeted ports: 2223. Country: China.
Observed 5 times. Targeted ports: 2223. Country: China.
Observed 7 times. Targeted ports: 2223. Country: China.
Observed 1 times. Country: Kazakhstan.
Observed 6 times. Targeted ports: 2096. Country: United States.
Observed 8 times. Targeted ports: 1433. Country: Pakistan.
Observed 6 times. Targeted ports: 7250. Country: United Kingdom. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 4 times. Targeted ports: 8880. Country: United Arab Emirates. Reputation: ssh abuse.
Observed 19 times. Targeted ports: 80. Country: The Netherlands. Reputation: scan source. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA HTTP Request excessive header repetition.
Observed 1 times. Country: China.
Observed 1 times. Targeted ports: 137. Country: Germany.
Observed 8 times. Targeted ports: 8118. Country: United States. Alert categories: Detection of a Network Scan. Signatures: ET SCAN Zmap User-Agent (Inbound).
Observed 711 times. Targeted ports: 3389. Country: France.
Observed 4 times. Targeted ports: 3388. Country: United States.
Observed 26 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 17 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 11 times. Targeted ports: 445. Country: India.
Observed 4 times. Targeted ports: 23. Country: Belgium.
Observed 6 times. Targeted ports: 445. Country: Tunisia.
Observed 2 times. Targeted ports: 8080. Country: Belgium.
Observed 8 times. Targeted ports: 9042. Country: United States. Reputation: bad reputation.