XXC/DEFENCE
EN/DA
HONEYPOT RESEARCH / OBSERVATIONS

Signals from the field.

Recent indicators collected through our honeypot research. A focused view of what we are observing, refreshed every ten minutes.

How our honeypots work
50Latest observations
MAX. 50
Snapshot updated

These observations are candidates, not a verdict. Correlate them with your own evidence before taking action. Source IPs identify observed connections, not the people behind them.

Latest observations · All times in UTC
TypeIndicatorLast seenObservations
Source IP 217[.]60[.]76[.]167 Category: Attacker Observed source 1
Source IP 185[.]24[.]11[.]158 Category: Attacker Observed source 48
Source IP 5[.]196[.]115[.]99 Category: Attacker Observed source 2,871
Source IP 62[.]31[.]244[.]106 Category: Attacker Observed source 2
Source IP 121[.]184[.]203[.]46 Category: Attacker Observed source 52
Source IP 152[.]32[.]252[.]94 Category: Attacker Observed source 5
Source IP 205[.]210[.]31[.]91 Category: Attacker Observed source 1
Source IP 51[.]75[.]106[.]116 Category: Attacker Observed source 56
Source IP 150[.]109[.]10[.]41 Category: Attacker Observed source 1
Source IP 158[.]178[.]130[.]68 Category: Attacker Observed source 2
Source IP 82[.]165[.]34[.]39 Category: Attacker Observed source 975
Source IP 52[.]231[.]71[.]30 Category: Attacker Observed source 1
Source IP 113[.]21[.]37[.]97 Category: Attacker Observed source 1
Source IP 66[.]132[.]195[.]69 Category: Attacker Observed source 3
Source IP 143[.]244[.]57[.]84 Category: Attacker Observed source 21
Source IP 195[.]96[.]139[.]226 Category: Attacker Observed source 2
Source IP 45[.]112[.]149[.]170 Category: Attacker Observed source 102
Source IP 195[.]164[.]49[.]144 Category: Attacker Observed source 3
Source IP 49[.]142[.]149[.]169 Category: Attacker Observed source 53
Source IP 172[.]232[.]108[.]36 Category: Attacker Observed source 2
Source IP 198[.]11[.]177[.]243 Category: Attacker Observed source 1
Source IP 195[.]96[.]139[.]179 Category: Attacker Observed source 1
Source IP 54[.]38[.]196[.]18 Category: Attacker Observed source 1
Source IP 43[.]159[.]34[.]167 Category: Attacker Observed source 1
Source IP 205[.]210[.]31[.]64 Category: Attacker Observed source 1
Source IP 43[.]131[.]32[.]36 Category: Attacker Observed source 1
Source IP 152[.]228[.]236[.]215 Category: Attacker Observed source 3
Source IP 125[.]26[.]175[.]50 Category: Attacker Observed source 35
Source IP 59[.]29[.]75[.]107 Category: Attacker Observed source 2
Source IP 94[.]247[.]172[.]129 Category: Attacker Observed source 1
Source IP 98[.]91[.]201[.]14 Category: Attacker Observed source 3
Source IP 52[.]233[.]89[.]176 Category: Attacker Observed source 1
Source IP 43[.]160[.]219[.]138 Category: Attacker Observed source 1
Source IP 147[.]185[.]132[.]81 Category: Attacker Observed source 1
Source IP 198[.]235[.]24[.]89 Category: Attacker Observed source 1
Source IP 40[.]124[.]123[.]24 Category: Attacker Observed source 1
Source IP 64[.]177[.]49[.]77 Category: Attacker Observed source 2
Source IP 49[.]51[.]253[.]83 Category: Attacker Observed source 1
Source IP 43[.]166[.]128[.]187 Category: Attacker Observed source 1
Source IP 171[.]114[.]229[.]252 Category: Attacker Observed source 1
Source IP 43[.]159[.]135[.]203 Category: Attacker Observed source 1
Source IP 20[.]51[.]218[.]38 Category: Attacker Observed source 1
Source IP 198[.]235[.]24[.]112 Category: Attacker Observed source 1
Source IP 119[.]154[.]229[.]34 Category: Attacker Observed source 1
Source IP 43[.]135[.]186[.]135 Category: Attacker Observed source 1
Source IP 102[.]45[.]192[.]19 Category: Attacker Observed source 1
Source IP 204[.]101[.]161[.]15 Category: Attacker Observed source 2
Source IP 216[.]251[.]143[.]109 Category: Attacker Observed source 2
Source IP 43[.]160[.]241[.]129 Category: Attacker Observed source 1
Source IP 151[.]243[.]11[.]230 Category: Attacker Observed source 6
Indicators are displayed as defanged, non-clickable text.All times in UTC