Threat Intelligence Feeds
Lists of IP addresses that attacked our honeypots, generated hourly by our SIEM platform. They are free to use in your own SIEM, firewall or blocklists under the CC BY 4.0 licence.
Downloads
- Brute-force IOC data: addresses that tried to guess logins (for example SSH).
- Port-scan IOC data: addresses that scanned for open ports.
- Web-attack IOC data: addresses that probed for web vulnerabilities, such as exposed admin pages, credentials or known CVEs.
File format
Each file is a gzip-compressed CSV with a header row and these columns:
| Column | Meaning | Example |
|---|---|---|
ip |
The attacking IP address | 192.0.2.10 |
weight |
How active the address has been. Higher numbers mean more activity. | 44 |
last_seen |
When the address was last seen, as a Unix timestamp (seconds since 1 Jan 1970 UTC) | 1788592596 |
Licence
The feeds are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You may use, share and adapt them for any purpose, including commercially, as long as you credit Second Edge, for example:
Threat data from Second Edge (https://www.second-edge.com/intel.html), licensed under CC BY 4.0.
The full licence text is in LICENSE.txt, next to the data files.
Disclaimer
The feeds are generated automatically from honeypot logs and are provided as is, without warranty of any kind. They may contain errors, out-of-date entries or false positives: for example, a shared or reassigned IP address may now be used by someone else. Check the data before acting on it, and don't use it as the only basis for blocking traffic. To the extent permitted by law, Second Edge accepts no liability for any loss or damage arising from its use.
Fair use
The files are regenerated every hour. Please download each file no more than once an hour: addresses that download more often are banned.
Example
Download and unpack the brute-force list:
curl -sS https://www.second-edge.com/data/threatintel_bruteforce.csv.gz | gunzip