Threat Intelligence
Global Threat Feed
Curated IOC feeds and live honeypot attack telemetry
Active IOCs
42,972
in curated feeds
Feeds
4
phishing · abuse · tor
Honeypot hits
500,943
attacks captured
Attack payloads
21,118
distinct signatures
Threat Intelligence Feeds
Indicators of compromise mirrored from public reputation feeds. We surface aggregate counts only — individual phishing URLs are never listed. Matched against every IP, prefix, country and TLD across the site.
| Feed | Category | Type | Indicators | Last updated |
|---|---|---|---|---|
| OpenPhish | phishing | url | 19,846 | 2026-07-21 12:59:48 |
| FireHOL Level 1 | abuse | cidr | 13,909 | 2026-07-21 12:59:48 |
| Spamhaus DROP | spam | cidr | 5,061 | 2026-07-21 12:59:48 |
| Tor Exit Nodes | anonymizer | ip | 4,156 | 2026-07-21 12:59:47 |
Honeypot Attack Activity
Unsolicited traffic hitting our distributed sensors — services no legitimate client should ever reach. A clean, high-signal view of what is actively being scanned and exploited in the wild.
Raw payloads
232,152 · 6,004 sigs
Auth brute-force
221,867 · 4 sigs
HTTP scans
32,601 · 10,936 sigs
HTTP exploit probes
14,323 · 4,174 sigs
Live Exploit Signatures
The most frequent HTTP exploit attempts our sensors observe — IoT RCE, command injection, webshell drops and CVE probes. Request targets are shown; sensor addresses are redacted.
| Attack class | Request | Hits |
|---|---|---|
|
iot-rce
|
GET /cgi-bin/luci/;stok=/locale | 370 |
|
cmdi
iot-rce
|
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh | 187 |
|
scanner-ua
|
GET / | 146 |
|
scanner-ua
|
GET / | 121 |
|
cmdi
iot-rce
|
POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%... | 86 |
|
webshell
cve-probe
|
POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input | 81 |
|
webshell
cve-probe
|
POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input | 79 |
|
webshell
|
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 76 |
|
cmdi
|
POST /goform/set_LimitClient_cfg | 73 |
|
webshell
|
GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php | 71 |
|
webshell
|
GET /vendor/phpunit/src/Util/PHP/eval-stdin.php | 69 |
|
webshell
|
GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php | 68 |
|
webshell
|
GET /vendor/phpunit/Util/PHP/eval-stdin.php | 68 |
|
webshell
|
GET /phpunit/phpunit/Util/PHP/eval-stdin.php | 67 |
|
webshell
|
GET /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 67 |
|
webshell
|
GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 67 |
|
webshell
|
GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php | 67 |
|
webshell
|
GET /phpunit/src/Util/PHP/eval-stdin.php | 67 |
|
webshell
|
GET /phpunit/Util/PHP/eval-stdin.php | 67 |
|
config-probe
|
GET /.env | 66 |
|
webshell
|
GET /lib/phpunit/phpunit/Util/PHP/eval-stdin.php | 66 |
|
webshell
|
GET /lib/phpunit/src/Util/PHP/eval-stdin.php | 64 |
|
webshell
|
GET /lib/phpunit/Util/PHP/eval-stdin.php | 63 |
|
config-probe
|
GET /.env.development | 63 |
|
config-probe
|
GET /.env.production | 62 |