Publicly available data feeds derived from passive observation of unsolicited traffic across our global sensor network. Updated continuously, freely downloadable. All feeds are plain-text - one IPv4 address per line, annotated with ASN, organization, and country.
IP addresses observed sending various DNS query types to our sensors - indicators of resolvers, scanners, and misconfigured hosts.
| Feed | Description | Actions |
|---|---|---|
| dnsrd Recursion Desired |
Source IPs sending DNS queries with the recursion desired (RD) bit set, querying for random or non-existent labels. Commonly associated with open resolver probing and DNS scanning activity. |
Download Stats |
| dnsrdany Recursion Desired IN ANY |
Source IPs sending DNS IN ANY queries with the recursion desired bit set. ANY queries historically return large responses and are associated with DNS amplification attack reconnaissance. |
Download Stats |
| dnsrdtcp Recursion Desired TCP |
Source IPs sending DNS queries with recursion desired over TCP instead of UDP. TCP is used when UDP responses are truncated - repeated TCP queries for random labels indicate scanning. |
Download Stats |
| dnsrname Type Name (RNAME) |
Source IPs sending DNS IN NAME queries - a legacy query type rarely used in legitimate resolution. Presence is a reliable indicator of scanning or probe infrastructure. |
Download Stats |
| dnsch CH TXT version.bind |
Source IPs querying CHAOS class TXT records for version.bind - a classic technique for fingerprinting DNS server software and version. Consistently associated with reconnaissance activity. |
Download Stats |
IP addresses observed in IPv6-related traffic reaching our sensors, including encapsulation and transition mechanism activity.
| Feed | Description | Actions |
|---|---|---|
| proto41 Protocol 41 - IPv6 in IPv4 Encapsulation |
Source IPs observed sending unsolicited IPv6-in-IPv4 encapsulated packets (Protocol 41). This traffic is associated with 6in4 tunnel probing and IPv6 transition mechanism scanning. |
Download Stats |
IP addresses observed sending NTP request modes to our sensors - indicators of time synchronization clients, monlist scanners, and control query probes.
| Feed | Description | Actions |
|---|---|---|
| ntpmode3 Mode 3 - Client |
Source IPs sending NTP Mode 3 (client) requests. While standard NTP behavior, large volumes arriving at passive sensors indicate Internet-wide NTP probing or misconfigured clients. |
Download Stats |
| ntpmode6 Mode 6 - Control Query |
Source IPs sending NTP Mode 6 control queries. Mode 6 is used by ntpq for management - unsolicited mode 6 traffic at sensors indicates NTP management interface scanning. |
Download Stats |
| ntpmode7 Mode 7 - Monlist |
Source IPs sending NTP Mode 7 (monlist) requests. Mode 7 is a legacy NTP feature notoriously abused for DDoS amplification. Any Mode 7 traffic at sensors is aberrant. |
Download Stats |
IP addresses observed sending unsolicited SIP request methods to our sensors - indicators of VoIP infrastructure scanning and potential toll fraud precursors.
| Feed | Description | Actions |
|---|---|---|
| sipinvitation Invitation (INVITE) |
Source IPs sending unsolicited SIP INVITE requests. INVITE is the primary method for establishing VoIP calls - probing sensors with INVITE is a strong indicator of toll fraud reconnaissance. |
Download Stats |
| sipoptions Query (OPTIONS) |
Source IPs sending unsolicited SIP OPTIONS requests. OPTIONS is used to query capabilities of a SIP server - unsolicited OPTIONS traffic is a reliable indicator of VoIP infrastructure scanning. |
Download Stats |
| sipregistration Registration (REGISTER) |
Source IPs sending unsolicited SIP REGISTER requests. REGISTER is used to associate a SIP address with a location - unsolicited traffic indicates scanning for registrar weaknesses. |
Download Stats |
IP addresses observed sending unsolicited SMTP commands to our sensors - indicators of hosts probing email infrastructure.
| Feed | Description | Actions |
|---|---|---|
| smtpdata Data (DATA) |
Source IPs observed sending the SMTP DATA command to sensors. Reaching DATA implies successful HELO/EHLO and RCPT TO negotiation - these IPs actively attempted to deliver email to our sensors. |
Download Stats |
| smtpgreet Greeting (HELO/EHLO) |
Source IPs sending unsolicited SMTP HELO or EHLO greetings. This is the opening handshake of SMTP - high volume from diverse IPs indicates broad email infrastructure scanning. |
Download Stats |
IP addresses observed attempting SSH connections and authentication to our sensors - strong indicators of Internet-wide scanning and brute-force activity.
| Feed | Description | Actions |
|---|---|---|
| sshclient Client Connection |
Source IPs observed completing the SSH client handshake (protocol version exchange and key exchange). These IPs probed our sensors at the SSH connection level - not necessarily attempting login. |
Download Stats |
| sshpwauth Password Authentication |
Source IPs observed attempting SSH password authentication against our sensors. These IPs completed the SSH handshake and submitted one or more password credentials. |
Download Stats |
| sshpwauthpairs ID/Password Pairs |
Username and password strings (not just source IPs) observed in SSH password authentication attempts. Published as tab-separated username:password pairs - useful for credential analysis and blocklist tuning. |
Download |
IP addresses observed sending Telnet login attempts to our sensors - indicators of scanning targeting legacy remote access services.
| Feed | Description | Actions |
|---|---|---|
| telnetlogin Login |
Source IPs observed sending Telnet login requests to our sensors. Telnet is deprecated for secure administration but remains widely exploited in IoT compromises and legacy device targeting. |
Download Stats |
IP addresses observed attempting VNC connections and authentication to our sensors - indicators of remote desktop scanning activity.
| Feed | Description | Actions |
|---|---|---|
| vncrfb RFB (Remote Framebuffer) |
Source IPs observed initiating the VNC RFB protocol handshake with our sensors. RFB is the underlying protocol for VNC remote desktop access - unsolicited connections indicate scanning for exposed desktops. |
Download Stats |