Honeypot infrastructure watch
A community-maintained watchlist of IP infrastructure observed through honeypot telemetry. Historical observations include original tags, hit counts, and first/last-seen dates.
IOC feed · 505,486 indicators
Latest indicators
Live indicator delivery for this feed.
Observed 4 times. Targeted ports: 22. Country: Belgium.
Observed 8 times. Targeted ports: 1433. Country: United States.
Observed 5 times. Targeted ports: 7777. Country: United States. Reputation: bad reputation.
Observed 5 times. Targeted ports: 9000. Country: United States. Reputation: bad reputation.
Observed 25 times. Targeted ports: 8000. Country: Belgium.
Observed 6 times. Targeted ports: 1229. Country: United States. Reputation: mass scanner.
Observed 1 times. Targeted ports: 137. Country: United Kingdom.
Observed 7 times. Targeted ports: 24006. Country: France. Reputation: mass scanner.
Observed 2 times. Targeted ports: 990. Country: China.
Observed 5 times. Targeted ports: 50000. Country: United States. Reputation: bad reputation.
Observed 4 times. Targeted ports: 3000. Country: United States. Reputation: scan source.
Observed 21 times. Targeted ports: 10490. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 9163. Country: United Kingdom. Reputation: bad reputation.
Observed 2 times. Targeted ports: 8080. Country: Belgium.
Observed 4 times. Targeted ports: 8123. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 23. Country: Ukraine.
Observed 1 times. Targeted ports: 5632. Country: United States. Reputation: scan source.
Observed 5 times. Targeted ports: 2022. Country: China. Reputation: bad reputation.
Observed 4 times. Targeted ports: 2375. Country: China. Reputation: bad reputation.
Observed 5 times. Targeted ports: 9642. Country: United States. Reputation: bad reputation.
Observed 289 times. Targeted ports: 445. Country: China. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA STREAM spurious retransmission. Usernames: Administrator.
Observed 7 times. Targeted ports: 22. Country: Argentina.
Observed 4 times. Targeted ports: 8443. Country: United States.
Observed 2 times. Targeted ports: 81. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 8022. Country: United States. Reputation: bad reputation.
Observed 5 times. Targeted ports: 9000. Country: Portugal. Reputation: mail abuse.
Observed 7 times. Targeted ports: 9000. Country: Portugal. Reputation: mail abuse.
Observed 7 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA TCPv4 invalid checksum.
Observed 4 times. Targeted ports: 9669. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 8001. Country: United States.
Observed 11 times. Targeted ports: 9000. Country: Portugal. Reputation: mail abuse.
Observed 3 times. Targeted ports: 10060. Country: Hong Kong. Reputation: scan source.
Observed 4 times. Targeted ports: 1028. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 9000. Country: Portugal. Reputation: mail abuse.
Observed 4 times. Targeted ports: 3453. Country: United Kingdom. Reputation: bad reputation.
Observed 1 times. Targeted ports: 53. Country: United States.
Observed 1 times. Country: Hong Kong.
Observed 5 times. Targeted ports: 51401. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 2375. Country: China. Reputation: bot activity.
Observed 4 times. Targeted ports: 16894. Country: United States. Reputation: scan source.
Observed 24 times. Targeted ports: 445. Country: Thailand. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 4 times. Targeted ports: 5269. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 4000. Country: Poland. Reputation: bad reputation.
Observed 14 times. Targeted ports: 50500. Country: United States. Reputation: service abuse.
Observed 13 times. Targeted ports: 10801. Country: United States. Reputation: service abuse.
Observed 11 times. Targeted ports: 23956. Country: United States. Reputation: scan source.
Observed 11 times. Targeted ports: 22. Country: China. Reputation: bad reputation. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 5 times. Targeted ports: 40000. Country: Brazil. Reputation: scan source.
Observed 10 times. Targeted ports: 22. Country: Hong Kong. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 4 times. Targeted ports: 23. Country: Taiwan.
Observed 7 times. Targeted ports: 23. Country: India. Reputation: service abuse.
Observed 9 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA TCPv4 invalid checksum.
Observed 9 times. Targeted ports: 22. Country: China. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA TCPv4 invalid checksum.
Observed 5 times. Targeted ports: 50995. Country: United States. Reputation: scan source.
Observed 12 times. Targeted ports: 22. Country: India. Reputation: ssh abuse. Alert categories: Generic Protocol Command Decode, Misc activity. Signatures: ET INFO SSH session in progress on Expected Port, SURICATA STREAM spurious retransmission. Usernames: root.
Observed 11 times. Targeted ports: 22. Country: Spain. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: backend.
Observed 4 times. Targeted ports: 445. Country: Brazil. Reputation: scan source.
Observed 10 times. Targeted ports: 22. Country: Brazil. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: ss.
Observed 11 times. Targeted ports: 22. Country: Hong Kong. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 11 times. Targeted ports: 22. Country: India. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 12 times. Targeted ports: 80. Country: Italy.
Observed 17 times. Targeted ports: 445. Country: India. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 1 times. Targeted ports: 67. Country: United Kingdom.
Observed 10 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 15 times. Targeted ports: 445. Country: Egypt. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.
Observed 3 times. Targeted ports: 5200. Country: United States. Reputation: scan source.
Observed 6 times. Targeted ports: 23394. Country: United States. Reputation: scan source.
Observed 5 times. Targeted ports: 23. Country: South Africa.
Observed 13 times. Targeted ports: 8088. Country: United States. Reputation: service abuse.
Observed 11 times. Targeted ports: 22. Country: Philippines. Reputation: web attacker. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
Observed 3 times. Targeted ports: 2083. Country: United States. Reputation: mass scanner.
Observed 5 times. Targeted ports: 11495. Country: United States. Reputation: scan source.
Observed 9 times. Targeted ports: 22. Country: Hong Kong. Reputation: ssh abuse. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port.
Observed 5 times. Targeted ports: 5902. Country: United States. Reputation: scan source.
Observed 1 times. Targeted ports: 445. Country: Vietnam.
Observed 1 times. Targeted ports: 50000. Country: United States. Reputation: bad reputation.
Observed 2 times. Targeted ports: 880. Country: Seychelles. Reputation: bad reputation.
Observed 4 times. Targeted ports: 25565. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 137. Country: United Kingdom.
Observed 1 times. Country: Indonesia.
Observed 5 times. Targeted ports: 9200. Country: United States. Reputation: scan source.
Observed 4 times. Targeted ports: 9003. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 2363. Country: United States. Reputation: scan source.
Observed 3 times. Targeted ports: 8888. Country: United States. Reputation: mass scanner.
Observed 4 times. Targeted ports: 4782. Country: Belgium.
Observed 6 times. Targeted ports: 10129. Country: China.
Observed 6 times. Targeted ports: 10129. Country: China.
Observed 8 times. Targeted ports: 10129. Country: China.
Observed 1 times. Targeted ports: 87. Country: United States. Reputation: mass scanner.
Observed 4 times. Targeted ports: 5556. Country: United States. Reputation: scan source.
Observed 6 times. Targeted ports: 10129. Country: China.
Observed 6 times. Targeted ports: 10129. Country: China.
Observed 3 times. Targeted ports: 50000. Country: United States. Reputation: mass scanner.
Observed 5 times. Targeted ports: 443. Country: United States. Reputation: bad reputation.
Observed 1537 times. Targeted ports: 1568, 1976, 2140, 2229, 2767, 2897, 3019, 3121, 4017, 4212, 5217, 5271, 5272, 6255, 6308, 6363, 6452, 7258, 7372, 7523, 7764, 8322, 8724, 9135, 9244, 9816, 10266, 10306, 10308, 10758, 11535, 11747, 11973, 11985, 11986, 11987, 12251, 12266, 12321, 12437, 12723, 12852, 13186, 13241, 13255, 13357, 13384, 13828, 14094, 14109, 14627, 14851, 16441, 16462, 16572, 16851, 17063, 17559, 18174, 18530, 19021, 19199, 19253, 19266, 19491, 19518, 19732, 19942, 20181, 20192, 20822, 21847, 22065, 22406, 22720, 22890, 23422, 23661, 24315, 24528, 24930, 24944, 25032, 25100, 25299, 25394, 25557, 25673, 25743, 25899, 27113, 27195, 27339, 27340, 27449, 27502, 27967, 27982, 28020, 28036, 28384, 28554, 29003, 29297, 29392, 29406, 29447, 29462, 29658, 29712, 30246, 30313, 30329, 30498, 30737, 30777, 30888, 30916, 30942, 31310, 31445, 31590, 31656, 32190, 32245, 32328, 32444, 32689, 32832, 32914, 33391, 33883, 33924, 33937, 33977, 34860, 35016, 35542, 35950, 36790, 37472, 38406, 39027, 40509, 40522, 40802, 40987, 41267, 41879, 42350, 43667, 43680, 44172, 44603, 44643, 44773, 45230, 45467, 45695, 45721, 45850, 45851, 46186, 47229, 47243, 47681, 48198, 48601, 48667, 48669, 48840, 49011, 49160, 49188, 49468, 49474, 49482, 49864, 50238, 50307, 50703, 51130, 51358, 52026, 52701, 53050, 53091, 53133, 53288, 53534, 53821, 53999, 54156, 54196, 54265, 54333, 54851, 54994, 55479, 55731, 55758, 55773, 55806, 56168, 56169, 56597, 56797, 57091, 57115, 57326, 57492, 57650, 57996, 58353, 58502, 58639, 58806, 59395, 59538, 60078, 60167, 60358, 60407, 60652, 61743, 61771, 62049, 62180, 62418, 63046, 63086, 63170, 63297, 63326, 63591, 64273, 64621. Country: Canada. Reputation: scan source.
Observed 35 times. Targeted ports: 9200. Country: United States. Reputation: scan source. Alert categories: Generic Protocol Command Decode. Signatures: SURICATA Applayer Wrong direction first Data.
Observed 21 times. Targeted ports: 6939. Country: United States.
Observed 5 times. Targeted ports: 49206. Country: United States. Reputation: bad reputation.
Observed 1 times. Targeted ports: 82. Country: United States. Reputation: mass scanner.
Observed 24 times. Targeted ports: 445. Country: Indonesia. Alert categories: Not Suspicious Traffic. Signatures: ET INFO Potentially unsafe SMBv1 protocol in use.