← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
TSEC Honeypot: General Activity - Week of 2026-04-27
WHITE ladarrellmiller 2026-04-27 Modified: 2026-05-31
129
IOCs
HIGH VOLUME
Honeypot-observed general activity activity for the week of 2026-04-27. Contains 28 indicators (28 IPv4). Data sourced from TSEC T-Pot honeypot network.
honeypotthreat-intelligencetpot
Indicators of Compromise (129)
All IPv4
TYPEINDICATORDESCRIPTIONCREATED
IPv4 171.120.25.138 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious, sector:energy. 171.120.25.138 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 101.249.63.106 Score: 75/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_level4, firehol:listed, gti:malicious. 101.249.63.106 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: FireHOL (firehol_level4). 2026-05-01
IPv4 182.88.191.239 Score: 50/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:suspicious, sector:energy, shodan:enriched. 182.88.191.239 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 110.177.179.127 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious, sector:healthcare. 110.177.179.127 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 80.94.250.83 Score: 50/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:healthcare. 80.94.250.83 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 194.169.90.34 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 194.169.90.34 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 45.186.52.224 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 45.186.52.224 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 109.199.104.138 Score: 60/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:energy. 109.199.104.138 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 45.162.79.226 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 45.162.79.226 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 123.160.233.148 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 123.160.233.148 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 1.193.63.181 Score: 50/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:energy. 1.193.63.181 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 124.66.72.42 Score: 50/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:healthcare. 124.66.72.42 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 113.164.230.36 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 113.164.230.36 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 47.237.216.143 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious, sector:healthcare. 47.237.216.143 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 176.31.139.22 Score: 50/100. Labels: abuseipdb:whitelisted, cowrie, firehol:unlisted, gti:exported, gti:suspicious, network:vpn. 176.31.139.22 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (whitelisted). 2026-05-01
IPv4 205.169.39.208 Score: 50/100. Labels: abuseipdb:whitelisted, cowrie, fatt, fingerprinting, firehol:unlisted, gti:exported. Attacker IP 205.169.39.208 observed using TLS client fingerprint 'Unknown TLS Client (d64ec57787f7)' 3 times when connecting to db1lapetro between 2026-05-01 03:22 and 2026-05-01 03:22 UTC. 2026-05-01
IPv4 205.169.39.207 Score: 50/100. Labels: abuseipdb:whitelisted, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 205.169.39.207 observed using TLS client fingerprint 'Unknown TLS Client (d64ec57787f7)' 3 times when connecting to db1lapetro between 2026-05-01 03:21 and 2026-05-01 03:21 UTC. 2026-05-01
IPv4 47.236.251.202 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 47.236.251.202 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to db1lapetro between 2026-05-01 03:13 and 2026-05-01 03:13 UTC. 2026-05-01
IPv4 43.98.161.96 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 43.98.161.96 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to db4lamedtech between 2026-05-01 03:10 and 2026-05-01 03:10 UTC. 2026-05-01
IPv4 41.111.142.198 Score: 50/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:healthcare. 41.111.142.198 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 217.23.1.5 Score: 95/100. Labels: abuseipdb:clean, cowrie, firehol:firehol_anonymous, firehol:firehol_proxies, firehol:listed, gti:exported. 217.23.1.5 classified as attacker with unclear intent (high confidence). Origin: enriched. Listed on: FireHOL (firehol_anonymous, firehol_proxies); AbuseIPDB (minimal, reported). 2026-05-01
IPv4 85.15.123.94 Score: 65/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:malicious. 85.15.123.94 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 137.184.59.230 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious, network:vpn. 137.184.59.230 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 64.235.40.106 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 64.235.40.106 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 123.14.122.71 Score: 50/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:healthcare. 123.14.122.71 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 118.81.85.207 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 118.81.85.207 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 161.97.173.220 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 161.97.173.220 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 180.95.238.43 Score: 60/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 180.95.238.43 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 123.163.114.133 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 123.163.114.133 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 103.139.59.224 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 103.139.59.224 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 31.186.175.50 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 31.186.175.50 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 119.18.62.198 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious, sector:healthcare. 119.18.62.198 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 45.225.92.92 Score: 65/100. Labels: abuseipdb:low, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported. 45.225.92.92 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (low, port-scan, reported). 2026-05-01
IPv4 157.7.223.24 Score: 55/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 157.7.223.24 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 1.85.218.92 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 1.85.218.92 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 120.48.88.69 Score: 55/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:healthcare. 120.48.88.69 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 47.237.214.134 Score: 50/100. Labels: abuseipdb:low, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported. 47.237.214.134 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (low, port-scan, reported). 2026-05-01
IPv4 185.156.46.163 Score: 75/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_abusers_30d, firehol:listed, gti:suspicious. 185.156.46.163 classified as attacker with unclear intent (high confidence). Origin: enriched. Listed on: FireHOL (firehol_abusers_30d); AbuseIPDB (minimal, reported). 2026-05-01
IPv4 23.234.93.207 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious, sector:healthcare. 23.234.93.207 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 51.159.210.196 Score: 55/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:exported, gti:suspicious, sector:energy. 51.159.210.196 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-01
IPv4 179.124.138.128 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 179.124.138.128 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 128.199.216.54 Score: 75/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 128.199.216.54 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 128.199.216.54 Score: 75/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 128.199.216.54 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 47.237.193.32 Score: 52/100. Labels: abuseipdb:low, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported. 47.237.193.32 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (low, port-scan, reported). 2026-05-01
IPv4 91.92.243.76 Score: 79/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_level1, firehol:listed, firehol:spamhaus_drop. 91.92.243.76 classified as commodity attacker using automated exploitation tooling (high confidence). Origin: enriched. Listed on: FireHOL (firehol_level1); AbuseIPDB (minimal, reported). 2026-05-01
IPv4 159.203.169.213 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, abuseipdb:well-known, cowrie, fatt, fingerprinting. Attacker IP 159.203.169.213 observed using TLS client fingerprint 'Unknown TLS Client (8e3145abdb9e)' 2 times when connecting to db4lamedtech between 2026-05-01 12:32 and 2026-05-01 12:32 UTC. 2026-05-01
IPv4 164.92.76.98 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 164.92.76.98 observed using TLS client fingerprint 'Unknown TLS Client (8e3145abdb9e)' 2 times when connecting to mdms1 between 2026-05-01 12:35 and 2026-05-01 12:35 UTC. 2026-05-01
IPv4 149.154.161.200 Score: 62/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:malicious. 149.154.161.200 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 43.225.189.144 Score: 66/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:malicious. 43.225.189.144 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 8.229.148.36 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 8.229.148.36 observed using TLS client fingerprint 'Unknown TLS Client (7465186b1421)' 2 times when connecting to offbackup1 between 2026-05-01 16:52 and 2026-05-01 16:52 UTC. 2026-05-01
IPv4 159.203.28.196 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 159.203.28.196 observed using TLS client fingerprint 'Unknown TLS Client (8e3145abdb9e)' 2 times when connecting to db4lamedtech between 2026-05-01 16:38 and 2026-05-01 16:38 UTC. 2026-05-01
IPv4 79.106.230.43 Score: 62/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:suspicious. 79.106.230.43 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 212.32.49.5 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:suspicious. Attacker IP 212.32.49.5 observed using TLS client fingerprint 'Unknown TLS Client (58b434b96f2d)' 2 times when connecting to db1lapetro between 2026-05-01 18:22 and 2026-05-01 18:33 UTC. 2026-05-01
IPv4 212.8.242.38 Score: 53/100. Labels: abuseipdb:low, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported. 212.8.242.38 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (low, port-scan, reported). 2026-05-01
IPv4 45.156.87.202 Score: 64/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_level1, firehol:firehol_level3, firehol:listed. 45.156.87.202 classified as commodity attacker using automated exploitation tooling (high confidence). Origin: enriched. Listed on: FireHOL (firehol_level1, firehol_level3); AbuseIPDB (minimal, reported). 2026-05-01
IPv4 46.151.182.131 Score: 73/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_level1, firehol:listed, firehol:spamhaus_drop. 46.151.182.131 classified as commodity attacker using automated exploitation tooling (high confidence). Origin: enriched. Listed on: FireHOL (firehol_level1); AbuseIPDB (minimal, reported). 2026-05-01
IPv4 138.197.33.109 Score: 51/100. Labels: abuseipdb:low, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported. 138.197.33.109 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (low, port-scan, reported). 2026-05-01
IPv4 177.85.72.78 Score: 65/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported, gti:malicious. 177.85.72.78 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-01
IPv4 166.62.124.255 Score: 53/100. Labels: abuseipdb:low, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted, gti:exported. 166.62.124.255 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (low, port-scan, reported). 2026-05-01
IPv4 188.166.53.121 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 188.166.53.121 observed using TLS client fingerprint 'Unknown TLS Client (8e3145abdb9e)' 2 times when connecting to db1lapetro between 2026-05-02 01:24 and 2026-05-02 01:24 UTC. 2026-05-02
IPv4 102.88.54.96 Score: 85/100. Labels: abuseipdb:clean, abuseipdb:reported-export, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 102.88.54.96 observed using HTTP client fingerprint 'HTTP Client: python-requests/2.26.0' 2 times when connecting to db4lamedtech between 2026-05-02 01:04 and 2026-05-02 02:15 UTC. 2026-05-02
IPv4 147.182.140.96 Score: 53/100. Labels: abuseipdb:low, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious. 147.182.140.96 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (low, port-scan, reported). 2026-05-02
IPv4 49.36.233.49 Score: 50/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:clean, sector:healthcare, shodan:enriched. 49.36.233.49 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-02
IPv4 42.85.198.121 Score: 60/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:malicious, sector:healthcare. 42.85.198.121 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-02
IPv4 216.26.242.95 Score: 85/100. Labels: abuseipdb:minimal, abuseipdb:reported, abuseipdb:reported-export, cowrie, fatt, fingerprinting. Attacker IP 216.26.242.95 observed using HTTP client fingerprint 'HTTP Client: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20...' 3 times when connecting to mdms1 between 2026-05-02 03:47 and 2026-05-02 03:47 UTC. 2026-05-02
IPv4 93.190.138.100 Score: 84/100. Labels: abuseipdb:clean, cowrie, firehol:firehol_anonymous, firehol:firehol_proxies, firehol:listed, gti:suspicious. 93.190.138.100 classified as attacker with unclear intent (high confidence). Origin: enriched. Listed on: FireHOL (firehol_anonymous, firehol_proxies); AbuseIPDB (clean). 2026-05-02
IPv4 47.236.98.85 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 47.236.98.85 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to db1lapetro between 2026-05-02 04:49 and 2026-05-02 04:49 UTC. 2026-05-02
IPv4 8.219.106.47 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 8.219.106.47 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to db4lamedtech between 2026-05-02 04:48 and 2026-05-02 04:48 UTC. 2026-05-02
IPv4 47.236.242.139 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 47.236.242.139 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to mdms1 between 2026-05-02 04:47 and 2026-05-02 04:47 UTC. 2026-05-02
IPv4 101.249.62.18 Score: 65/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_level4, firehol:listed, gti:malicious. 101.249.62.18 classified as scanning infrastructure conducting network reconnaissance (high confidence). Origin: enriched. Listed on: FireHOL (firehol_level4); AbuseIPDB (minimal, reported). 2026-05-02
IPv4 87.120.127.53 Score: 70/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:clean, gti:known-c2, network-intel. 87.120.127.53 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-02
IPv4 45.134.142.213 Score: 53/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_abusers_30d, firehol:listed, gti:clean. 45.134.142.213 classified as attacker with unclear intent (high confidence). Origin: enriched. Listed on: FireHOL (firehol_abusers_30d); AbuseIPDB (minimal, reported). 2026-05-02
IPv4 179.60.66.208 Score: 66/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:malicious, sector:energy. 179.60.66.208 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-02
IPv4 146.70.196.172 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 146.70.196.172 observed using TLS client fingerprint 'Unknown TLS Client (b3802c13664f)' 2 times when connecting to offbackup1 between 2026-05-02 12:42 and 2026-05-02 12:42 UTC. 2026-05-02
IPv4 213.191.220.125 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 213.191.220.125 observed using TLS client fingerprint 'Unknown TLS Client (e1cd52a33209)' 4 times when connecting to db4lamedtech between 2026-05-02 12:39 and 2026-05-02 13:16 UTC. 2026-05-02
IPv4 37.237.225.197 Score: 52/100. Labels: abuseipdb:minimal, abuseipdb:multi-reported, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious. 37.237.225.197 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, multi-reported, reported). 2026-05-02
IPv4 34.207.98.172 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 34.207.98.172 observed using TLS client fingerprint 'Unknown TLS Client (675b6d451c0b)' 2 times when connecting to mdms1 between 2026-05-02 16:05 and 2026-05-02 16:11 UTC. 2026-05-02
IPv4 54.236.29.75 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 54.236.29.75 observed using TLS client fingerprint 'Unknown TLS Client (675b6d451c0b)' 2 times when connecting to mdms1 between 2026-05-02 16:01 and 2026-05-02 16:18 UTC. 2026-05-02
IPv4 107.152.36.33 Score: 70/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:clean, network-intel, sector:government. IP observed in Suricata network metadata 2026-05-02
IPv4 23.234.68.67 Score: 66/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:malicious, network-intel. IP observed in Suricata network metadata 2026-05-02
IPv4 199.195.249.83 Score: 52/100. Labels: abuseipdb:clean, client:libssh, cowrie, firehol:unlisted, gti:dns:botnet-infra, gti:dns:dga-pattern. IP observed in Suricata network metadata 2026-05-02
IPv4 176.123.1.116 Score: 67/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:malicious. IP observed in Suricata network metadata 2026-05-02
IPv4 103.246.250.145 Score: 51/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:suspicious. IP observed in Suricata network metadata 2026-05-02
IPv4 51.254.17.136 Score: 56/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:suspicious. IP observed in Suricata network metadata 2026-05-02
IPv4 91.208.184.242 Score: 58/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:suspicious. IP observed in Suricata network metadata 2026-05-02
IPv4 51.68.126.146 Score: 57/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:suspicious. IP observed in Suricata network metadata 2026-05-02
IPv4 185.134.49.179 Score: 76/100. Labels: abuseipdb:clean, client:libssh, cowrie, firehol:firehol_anonymous, firehol:firehol_level1, firehol:firehol_proxies. 185.134.49.179 classified as commodity attacker using automated exploitation tooling (high confidence). Origin: enriched. Listed on: FireHOL (firehol_anonymous, firehol_level1); AbuseIPDB (clean). 2026-05-02
IPv4 159.203.25.138 Score: 57/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:dns:dga-pattern. 159.203.25.138 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-02
IPv4 89.163.145.38 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:suspicious. 89.163.145.38 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-02
IPv4 15.204.229.113 Score: 56/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, firehol:unlisted, gti:suspicious. 15.204.229.113 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-02
IPv4 39.49.148.31 Score: 60/100. Labels: abuseipdb:minimal, abuseipdb:reported, auth:failed, commands:executed, cowrie, firehol:unlisted. Attacker IP from Lahore, Pakistan (AS17557, Pakistan Telecommunication Company Limited). Observed targeting healthcare sector honeypot mdms-hp-01 via cowrie. Session included delivery of 1 malware sample. 2 events. 2026-05-02
IPv4 185.134.49.60 Score: 50/100. Labels: abuseipdb:clean, client:libssh, cowrie, fatt, fingerprinting, firehol:firehol_level1. Attacker IP 185.134.49.60 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to mdms1 between 2026-05-02 23:10 and 2026-05-02 23:15 UTC. 2026-05-03
IPv4 162.144.84.221 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 162.144.84.221 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to mdms1 between 2026-05-02 23:10 and 2026-05-02 23:15 UTC. 2026-05-03
IPv4 154.12.225.236 Score: 50/100. Labels: abuseipdb:clean, client:libssh, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 154.12.225.236 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db4lamedtech between 2026-05-02 23:08 and 2026-05-02 23:17 UTC. 2026-05-03
IPv4 83.220.173.216 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 83.220.173.216 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db1lapetro between 2026-05-02 23:05 and 2026-05-02 23:25 UTC. 2026-05-03
IPv4 31.42.189.159 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 31.42.189.159 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db1lapetro between 2026-05-02 23:04 and 2026-05-02 23:15 UTC. 2026-05-03
IPv4 69.175.92.21 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 69.175.92.21 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db1lapetro between 2026-05-02 23:04 and 2026-05-02 23:09 UTC. 2026-05-03
IPv4 209.126.2.70 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 209.126.2.70 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to mdms1 between 2026-05-02 23:08 and 2026-05-02 23:13 UTC. 2026-05-03
IPv4 37.27.7.160 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 37.27.7.160 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db1lapetro between 2026-05-02 23:10 and 2026-05-02 23:14 UTC. 2026-05-03
IPv4 99.192.162.179 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 99.192.162.179 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db1lapetro between 2026-05-02 22:59 and 2026-05-02 23:03 UTC. 2026-05-03
IPv4 23.133.64.107 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 23.133.64.107 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db1lapetro between 2026-05-02 22:59 and 2026-05-02 23:11 UTC. 2026-05-03
IPv4 198.20.127.158 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 198.20.127.158 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to mdms1 between 2026-05-02 22:58 and 2026-05-02 23:02 UTC. 2026-05-03
IPv4 185.134.49.2 Score: 50/100. Labels: abuseipdb:clean, client:libssh, cowrie, fatt, fingerprinting, firehol:firehol_level1. Attacker IP 185.134.49.2 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db1lapetro between 2026-05-02 22:58 and 2026-05-02 23:01 UTC. 2026-05-03
IPv4 78.111.67.246 Score: 50/100. Labels: abuseipdb:clean, client:libssh, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 78.111.67.246 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to mdms1 between 2026-05-02 22:58 and 2026-05-02 23:01 UTC. 2026-05-03
IPv4 198.98.60.130 Score: 50/100. Labels: abuseipdb:clean, client:libssh, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 198.98.60.130 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to mdms1 between 2026-05-02 22:55 and 2026-05-02 23:02 UTC. 2026-05-03
IPv4 45.43.45.254 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 45.43.45.254 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to mdms1 between 2026-05-02 22:57 and 2026-05-02 23:04 UTC. 2026-05-03
IPv4 23.94.23.226 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, client:libssh, cowrie, fatt, fingerprinting. Attacker IP 23.94.23.226 observed using SSH client fingerprint 'Unknown SSH Client (14b2ddda386a)' 2 times when connecting to db4lamedtech between 2026-05-02 22:50 and 2026-05-02 22:56 UTC. 2026-05-03
IPv4 47.237.125.164 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:suspicious. Attacker IP 47.237.125.164 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to db1lapetro between 2026-05-03 01:45 and 2026-05-03 01:46 UTC. 2026-05-03
IPv4 47.236.96.228 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 47.236.96.228 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to db4lamedtech between 2026-05-03 01:44 and 2026-05-03 01:44 UTC. 2026-05-03
IPv4 8.219.207.42 Score: 50/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 8.219.207.42 observed using TLS client fingerprint 'Unknown TLS Client (6b7366aa3f4b)' 2 times when connecting to mdms1 between 2026-05-03 01:44 and 2026-05-03 01:44 UTC. 2026-05-03
IPv4 138.197.177.173 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 138.197.177.173 observed using TLS client fingerprint 'Unknown TLS Client (8e3145abdb9e)' 2 times when connecting to db1lapetro between 2026-05-03 01:10 and 2026-05-03 01:10 UTC. 2026-05-03
IPv4 216.26.243.173 Score: 68/100. Labels: abuseipdb:clean, cowrie, firehol:firehol_level1, firehol:listed, firehol:spamhaus_drop, gti:suspicious. 216.26.243.173 classified as commodity attacker using automated exploitation tooling (high confidence). Origin: enriched. Listed on: FireHOL (firehol_level1); AbuseIPDB (clean). 2026-05-03
IPv4 68.168.222.65 Score: 85/100. Labels: abuseipdb:clean, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 68.168.222.65 observed using HTTP client fingerprint 'HTTP Client: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l...' 4 times when connecting to db4lamedtech between 2026-05-03 05:32 and 2026-05-03 05:32 UTC. 2026-05-03
IPv4 186.71.196.147 Score: 56/100. Labels: abuseipdb:iot-targeted, abuseipdb:moderate, abuseipdb:port-scan, abuseipdb:reported, cowrie, firehol:unlisted. 186.71.196.147 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (iot-targeted, moderate, port-scan). 2026-05-03
IPv4 64.227.165.137 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 64.227.165.137 observed using TLS client fingerprint 'Unknown TLS Client (8e3145abdb9e)' 2 times when connecting to mdms1 between 2026-05-03 07:33 and 2026-05-03 07:33 UTC. 2026-05-03
IPv4 64.226.124.169 Score: 60/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 64.226.124.169 observed using TLS client fingerprint 'Unknown TLS Client (b213b642d5cb)' 21 times when connecting to db1lapetro between 2026-05-03 07:26 and 2026-05-03 07:27 UTC. 2026-05-03
IPv4 177.105.246.51 Score: 60/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:suspicious, sector:healthcare, shodan:enriched. 177.105.246.51 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-03
IPv4 157.245.216.203 Score: 66/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_anonymous, firehol:firehol_proxies, firehol:listed. 157.245.216.203 classified as attacker with unclear intent (high confidence). Origin: enriched. Listed on: FireHOL (firehol_anonymous, firehol_proxies); AbuseIPDB (minimal, reported). 2026-05-03
IPv4 94.26.106.19 Score: 70/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_level1, firehol:listed, firehol:spamhaus_drop. 94.26.106.19 classified as commodity attacker using automated exploitation tooling (high confidence). Origin: enriched. Listed on: FireHOL (firehol_level1); AbuseIPDB (minimal, reported). 2026-05-03
IPv4 167.71.239.248 Score: 80/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:unlisted, gti:suspicious, network:vpn. 167.71.239.248 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported). 2026-05-03
IPv4 167.99.54.21 Score: 57/100. Labels: abuseipdb:minimal, abuseipdb:reported, abuseipdb:widely-reported, cowrie, firehol:unlisted, gti:suspicious. 167.99.54.21 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, reported, widely-reported). 2026-05-03
IPv4 64.225.72.98 Score: 51/100. Labels: abuseipdb:clean, cowrie, firehol:firehol_anonymous, firehol:firehol_level4, firehol:firehol_proxies, firehol:listed. 64.225.72.98 classified as scanning infrastructure conducting network reconnaissance (high confidence). Origin: enriched. Listed on: FireHOL (firehol_anonymous, firehol_level4); AbuseIPDB (clean). 2026-05-03
IPv4 125.26.230.133 Score: 61/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:malicious, sector:healthcare, shodan:enriched. 125.26.230.133 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-03
IPv4 3.125.212.24 Score: 90/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 3.125.212.24 observed using HTTP client fingerprint 'HTTP Client: python-requests/2.32.5' 6 times when connecting to db1lapetro between 2026-05-03 18:18 and 2026-05-03 18:54 UTC. 2026-05-03
IPv4 192.141.14.162 Score: 63/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:suspicious, sector:healthcare, shodan:enriched. 192.141.14.162 classified as attacker with unclear intent (medium confidence). Origin: enriched. Listed on: AbuseIPDB (clean). 2026-05-03
IPv4 178.33.33.135 Score: 70/100. Labels: abuseipdb:clean, cowrie, firehol:unlisted, gti:clean, network-intel, network:vpn. IP observed in Suricata network metadata 2026-05-03
IPv4 138.68.82.87 Score: 66/100. Labels: abuseipdb:minimal, abuseipdb:multi-reported, abuseipdb:reported, cowrie, firehol:unlisted, gti:malicious. 138.68.82.87 classified as scanning infrastructure conducting network reconnaissance (medium confidence). Origin: enriched. Listed on: AbuseIPDB (minimal, multi-reported, reported). 2026-05-03
IPv4 17.22.253.7 Score: 85/100. Labels: abuseipdb:whitelisted, cowrie, fatt, fingerprinting, firehol:unlisted, gti:clean. Attacker IP 17.22.253.7 observed using HTTP client fingerprint 'HTTP Client: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/...' 2 times when connecting to mdms1 between 2026-05-03 21:57 and 2026-05-03 21:57 UTC. 2026-05-03
IPv4 104.236.50.250 Score: 50/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, fatt, fingerprinting, firehol:unlisted. Attacker IP 104.236.50.250 observed using TLS client fingerprint 'Unknown TLS Client (8e3145abdb9e)' 2 times when connecting to offbackup1 between 2026-05-03 21:41 and 2026-05-03 21:41 UTC. 2026-05-03