After some years of activities I decided to share a percentage of my personal honeypots to the community. The geographically located map shows the entire amount of malicious IPs it spots every 24h. Following you’ll find additional graph showing on selected honeypots locations. I’d like to highlights the event time distribution, since it’s nice to figure out when it is more likely an attack happens, special services hit, since it would be nice to figure out what are the most used services from attackers and protocol type closely related to services.

If you want you might download a complete list set of Malicious (in terms of HoneyPot) IPs by clicking the blue button. The list is provided as array of json objects for make you easy the ingestion.

Geo Distribution (updated every 24h)

Selected Event Distribution (updated every 24h)

Selected Detected Services (updated every 24h)

Selected Detected Protocols (updated every 24h)