Threat Intelligence

Global Threat Feed

Curated IOC feeds and live honeypot attack telemetry

Active IOCs

81,916

in curated feeds

Feeds

phishing · abuse · tor

Honeypot hits

1,280,746

attacks captured

Attack payloads

77,965

distinct signatures

Threat Intelligence Feeds

Indicators of compromise mirrored from public reputation feeds. We surface aggregate counts only — individual phishing URLs are never listed. Matched against every IP, prefix, country and TLD across the site.

Feed	Category	Type	Indicators	Last updated
OpenPhish	phishing	url	40,905	2026-08-30 18:06:38
FireHOL Level 1	abuse	cidr	28,147	2026-09-09 13:16:23
Spamhaus DROP	spam	cidr	6,782	2026-08-31 00:06:44
Tor Exit Nodes	anonymizer	ip	6,082	2026-08-31 00:06:39

Honeypot Attack Activity

Unsolicited traffic hitting our distributed sensors — services no legitimate client should ever reach. A clean, high-signal view of what is actively being scanned and exploited in the wild.

Raw payloads 575,091 · 11,473 sigs

Auth brute-force 521,918 · 4 sigs

HTTP scans 143,587 · 49,938 sigs

HTTP exploit probes 40,150 · 16,550 sigs

Live Exploit Signatures

The most frequent HTTP exploit attempts our sensors observe — IoT RCE, command injection, webshell drops and CVE probes. Request targets are shown; sensor addresses are redacted.

Attack class	Request	Hits
iot-rce	GET /cgi-bin/luci/;stok=/locale	377
scanner-ua	GET /	325
scanner-ua	GET /	317
cmdi iot-rce	POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh	239
iot-rce	GET /	162
cmdi	POST /goform/set_LimitClient_cfg	148
config-probe	GET /.git/config	136
scanner-ua	GET /developmentserver/metadatauploader	133
config-probe	GET /.env	128
config-probe	GET /.env.production	111
config-probe	GET /.env.prod	109
cmdi iot-rce	POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%...	108
config-probe	GET /.env.staging	107
webshell	GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	107
config-probe	GET /.env.development	107
config-probe	GET /.env.bak	107
config-probe	GET /.env.local	105
config-probe	GET /app/.env	105
config-probe	GET /.env.old	104
scanner-ua	GET /v1.16/version	103
config-probe	GET /.env.backup	101
webshell cve-probe	POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input	101
webshell	GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php	101
webshell	GET /vendor/phpunit/src/Util/PHP/eval-stdin.php	99
webshell cve-probe	POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input	99