Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 506,433 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 26 times. Targeted ports: 445. Country: Taiwan. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 3389. Country: United States. Reputation: scan source.
Observed 2 times. Targeted ports: 990. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 8443. Country: United States.
Observed 1 times. Targeted ports: 5060. Country: United Kingdom. Reputation: scan source.
Observed 11 times. Targeted ports: 49502. Country: United States. Reputation: bad reputation.
Observed 25 times. Targeted ports: 445. Country: Mexico. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 5 times. Targeted ports: 23003. Country: France. Reputation: mass scanner.
Observed 4 times. Targeted ports: 60000. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 80. Country: United States.
Observed 7 times. Targeted ports: 27010. Country: United States. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 6 times. Targeted ports: 45366. Country: United Kingdom. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 2 times. Targeted ports: 23. Country: China.
Observed 1951 times. Targeted ports: 23574, 23575, 23576, 23582, 23604, 23616, 23618, 23644, 23651, 23661, 23663, 23672, 23673, 23687, 23692, 23696, 23697, 23702, 23709, 23721, 23730, 23734, 23735, 23736, 23737, 23738, 23746, 23747, 23758, 23760, 23762, 23763, 23772, 23780, 23800, 23807, 23818, 23819, 23822, 23823, 23825, 23856, 23861, 23865, 23876, 23886, 23898, 23909, 23926, 23937, 23946, 23952, 23957, 23959, 23979, 23992, 24003, 24017, 24026, 24027, 24029, 24030, 24044, 24048, 24057. Country: United Kingdom.
Observed 3 times. Targeted ports: 2222. Country: United States.
Observed 4 times. Targeted ports: 2222. Country: United States. Reputation: bad reputation.
Observed 10 times. Targeted ports: 22. Country: Bangladesh. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: user.
Observed 6 times. Targeted ports: 2607. Country: France. Reputation: mass scanner.
Observed 2 times. Targeted ports: 123. Country: United States. Reputation: bad reputation.
Observed 6 times. Targeted ports: 38190. Country: United Kingdom. Reputation: bad reputation.
Observed 9 times. Targeted ports: 22. Country: Iran. Reputation: bad reputation. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 14 times. Targeted ports: 2404. Country: United States. Reputation: forum spammer.
Observed 5 times. Targeted ports: 51918. Country: United Kingdom. Reputation: bad reputation.
Observed 2 times. Targeted ports: 13118. Country: China. Alert categories: Attempted Information Leak. Signatures: ET SCAN NMAP -sS window 1024.
Observed 2290 times. Targeted ports: 23565, 23570, 23585, 23589, 23610, 23614, 23619, 23622, 23633, 23640, 23648, 23652, 23667, 23681, 23695, 23698, 23701, 23708, 23719, 23768, 23774, 23784, 23792, 23820, 23839, 23844, 23852, 23872, 23874, 23877, 23878, 23879, 23895, 23914, 23919, 23924, 23927, 23929, 23940, 23943, 23944, 23958, 23969, 23982, 23983, 23996, 23997, 24001, 24010, 24015, 24038, 24060. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission.
Observed 1458 times. Targeted ports: 23564, 23584, 23591, 23592, 23594, 23684, 23688, 23706, 23707, 23711, 23715, 23743, 23750, 23754, 23814, 23838, 23847, 23849, 23871, 23880, 23887, 23922, 23951, 23954, 23973, 23976, 23980, 23984, 23989, 24002, 24011, 24013, 24034, 24047, 24061. Country: United Kingdom.
Observed 772 times. Targeted ports: 23620, 23626, 23655, 23676, 23722, 23727, 23728, 23731, 23806, 23812, 23831, 23889, 23962, 23966, 23986, 24021, 24022, 24031, 24046. Country: United Kingdom.
Observed 360 times. Targeted ports: 23577, 23586, 23669, 23675, 23739, 23795, 23931, 24052, 24056. Country: United Kingdom.
Observed 565 times. Targeted ports: 23560, 23583, 23612, 23718, 23752, 23753, 23769, 23796, 23798, 23836, 23866, 23869, 23892, 23907. Country: United Kingdom.
Observed 802 times. Targeted ports: 23596, 23627, 23637, 23642, 23660, 23717, 23740, 23773, 23777, 23805, 23828, 23853, 23870, 23913, 23916, 23947, 23950, 23999, 24024, 24055. Country: United Kingdom.
Observed 934 times. Targeted ports: 23599, 23693, 23714, 23720, 23733, 23751, 23759, 23766, 23767, 23779, 23821, 23842, 23873, 23896, 23901, 23911, 23917, 23930, 23971, 24004, 24012, 24036, 24039, 24059. Country: United Kingdom.
Observed 771 times. Targeted ports: 23573, 23590, 23595, 23601, 23607, 23630, 23638, 23647, 23654, 23679, 23689, 23703, 23729, 23748, 23781, 23816, 23832, 23988, 23991. Country: United Kingdom.
Observed 1285 times. Targeted ports: 23558, 23559, 23568, 23569, 23606, 23608, 23611, 23615, 23636, 23664, 23680, 23694, 23741, 23765, 23789, 23791, 23824, 23837, 23860, 23863, 23881, 23885, 23932, 23939, 23948, 23961, 23993, 24009, 24025, 24032, 24063. Country: United Kingdom.
Observed 654 times. Targeted ports: 23602, 23649, 23668, 23674, 23678, 23691, 23704, 23732, 23803, 23817, 23858, 23960, 23967, 23981, 24023, 24040. Country: United Kingdom.
Observed 83 times. Targeted ports: 23613, 24006. Country: United Kingdom.
Observed 127 times. Targeted ports: 23724, 23882, 23905. Country: United Kingdom.
Observed 241 times. Targeted ports: 23603, 23899, 23918, 24005, 24043, 24062. Country: United Kingdom.
Observed 4 times. Targeted ports: 9000. Country: United States. Reputation: service abuse.
Observed 25 times. Targeted ports: 4242. Country: United States. Reputation: bad reputation.
Observed 18 times. Targeted ports: 22, 23. Country: Sweden.
Observed 22 times. Targeted ports: 6688. Country: United States.
Observed 4 times. Targeted ports: 1434. Country: United States. Reputation: bad reputation.
Observed 5 times. Targeted ports: 22. Country: Bulgaria. Reputation: web attacker.
Observed 19 times. Targeted ports: 4120. Country: Germany. Reputation: bad reputation.
Observed 4 times. Targeted ports: 8000. Country: United States. Reputation: scan source.
Observed 2 times. Targeted ports: 443. Country: Germany.
Observed 1 times. Country: Saudi Arabia.
Observed 7 times. Targeted ports: 22222. Country: Hong Kong.
Observed 1 times. Targeted ports: 80. Country: Hong Kong. Reputation: scan source.
Observed 1 times. Targeted ports: 5900. Country: United States. Reputation: scan source.
Observed 1 times. Country: The Netherlands.
Observed 2 times. Targeted ports: 23. Country: Malaysia.
Observed 1 times. Targeted ports: 11211. Country: Germany.
Observed 5 times. Targeted ports: 80. Country: Canada. Reputation: bad reputation.
Observed 46 times. Targeted ports: 23577, 23586, 23669, 23739, 23792, 23795, 23827, 23927, 23931, 24052, 24056. Country: United Kingdom.
Observed 11 times. Targeted ports: 22. Country: Australia. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: admin.
Observed 34 times. Targeted ports: 1723. Country: United States.
Observed 1 times. Country: Luxembourg.
Observed 1 times. Targeted ports: 1900. Country: France.
Observed 10 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: liyan.
Observed 6 times. Targeted ports: 445. Country: Thailand.
Observed 4 times. Targeted ports: 8085. Country: United States.
Observed 6 times. Targeted ports: 22. Country: China. Reputation: attack source.
Observed 14 times. Targeted ports: 7337. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 3389. Country: United Kingdom.
Observed 6 times. Targeted ports: 29766. Country: United Kingdom. Reputation: bad reputation. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM Packet with broken ack.
Observed 2 times. Targeted ports: 13120. Country: Germany. Reputation: scan source. Alert categories: Misc Attack. Signatures: ET DROP Dshield Block Listed Source group 1.
Observed 11 times. Targeted ports: 49152. Country: United States. Reputation: bad reputation.
Observed 8 times. Targeted ports: 22222. Country: China.
Observed 4 times. Targeted ports: 26386. Country: United Kingdom. Reputation: bad reputation.
Observed 4 times. Targeted ports: 22. Country: The Netherlands. Reputation: ssh abuse.
Observed 4 times. Targeted ports: 50443. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 5672. Country: United States. Reputation: bad reputation.
Observed 1 times. Country: United Kingdom.
Observed 4 times. Targeted ports: 8443. Country: United States.
Observed 5 times. Targeted ports: 24442. Country: United States. Reputation: bad reputation.
Observed 10 times. Targeted ports: 22. Country: Japan. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: AdminGPON.
Observed 1 times. Targeted ports: 23. Country: South Korea. Reputation: bad reputation.
Observed 4 times. Targeted ports: 8189. Country: Singapore. Reputation: bad reputation.
Observed 12 times. Targeted ports: 10261. Country: United States. Reputation: scan source.
Observed 2 times. Targeted ports: 21. Country: United Kingdom.
Observed 2 times. Targeted ports: 21. Country: United States. Reputation: ssh abuse.
Observed 13 times. Targeted ports: 443. Country: Germany. Reputation: web blacklist.
Observed 4 times. Targeted ports: 37443. Country: China.
Observed 7 times. Targeted ports: 22. Country: Morocco.
Observed 1 times. Targeted ports: 58238. Country: United Arab Emirates.
Observed 4 times. Targeted ports: 4796. Country: Bulgaria. Reputation: bad reputation. Alert categories: Misc activity. Signatures: GPL ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited.
Observed 1 times. Targeted ports: 23. Country: China.
Observed 3 times. Targeted ports: 6379. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 2323. Country: United States. Reputation: bad reputation.
Observed 3 times. Targeted ports: 22. Country: Germany. Reputation: scan source. Alert categories: Misc Attack. Signatures: ET DROP Spamhaus DROP Listed Traffic Inbound group 67.
Observed 11 times. Targeted ports: 9440. Country: The Netherlands. Reputation: ftp abuse.
Observed 2 times. Targeted ports: 3389. Country: France.
Observed 2 times. Targeted ports: 5631. Country: United Kingdom. Reputation: bad reputation.
Observed 2 times. Targeted ports: 3389. Country: France.
Observed 1 times. Targeted ports: 139. Country: France. Reputation: bad reputation.
Observed 4 times. Targeted ports: 52724, 54150. Country: France. Reputation: scan source.
Observed 2 times. Targeted ports: 3389. Country: The Netherlands. Reputation: scan source.
Observed 11 times. Targeted ports: 22. Country: Latvia. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 1 times. Targeted ports: 49957. Country: United Kingdom. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM RST recv but no session.