Honeypot Threat Feed

What this is

A free IP blocklist generated from my own honeypot sensors — decoy SSH, FTP, telnet, MySQL, and VNC services I run on real, internet-exposed infrastructure. Every IP on the list attacked a decoy service, at volume: most submitted login credentials repeatedly, and the rest hammered the honeypots with hundreds-to-thousands of credential-less probes. Nothing is inferred, scraped, or aggregated from third-party feeds: if an address is here, I watched it attack my machines.

It is deliberately a small, current list — only IPs active against the honeypots within the last 30 days — because a short honest feed you can drop straight into a firewall beats a huge stale one that blocks yesterday's attackers (and today's innocent reassignees).

Downloads

• blocklist.txt — one IP per line with a commented header. Drop-in for ipset, fail2ban, nginx, Postfix.
• blocklist.json — {meta, ips:[{ip, tier, bans, attempts, first_seen, last_seen}]} for programmatic use.
• blocklist.csv — spreadsheet / SIEM friendly.

URLs are stable. The list is regenerated hourly; polling more often than that gains nothing — please be polite and use If-Modified-Since or an hourly cron.

Inclusion criteria

Entries land on the list through one of two tiers (each entry is tagged with its tier in the JSON and CSV):

• Credential tier — observed making repeated credential-attack attempts (50 or more) against live honeypot sensors — confirmed by my own logs, not inferred.
• Scanner tier — never submitted credentials, but probed the honeypots at abusive volume: 1,000+ connection events within the window (roughly 33+ probes per day sustained against one quiet host). This catches high-volume protocol scanners — think VNC screen-scrapers — that a credentials-only rule would miss. The threshold sits in a measured order-of-magnitude gap in the volume distribution: casual and incidental scanners top out at a few hundred events, real abusers land in the thousands.
• Active within the last 30 days (both tiers) — entries age out automatically once an IP stops attacking.
• Private, reserved, and unroutable ranges are excluded from both tiers, as are the published scanner ranges of benign internet-survey projects (Censys, Rapid7 Sonar, Shadowserver, Shodan, BinaryEdge) so researchers never end up on the list — a check that matters doubly for the scanner tier, since survey projects also probe without credentials.

Usage examples

curl

curl -sO https://jacobrakai.org/feed/blocklist.txt

iptables + ipset

ipset create honeyfeed hash:ip -exist
curl -s https://jacobrakai.org/feed/blocklist.txt | grep -v '^#' | \
  while read -r ip; do ipset add honeyfeed "$ip" -exist; done
iptables -I INPUT -m set --match-set honeyfeed src -j DROP

fail2ban

# preload the feed into an existing jail (e.g. sshd)
curl -s https://jacobrakai.org/feed/blocklist.txt | grep -v '^#' | \
  xargs -n1 fail2ban-client set sshd banip

nginx deny

curl -s https://jacobrakai.org/feed/blocklist.txt | grep -v '^#' | \
  sed 's/.*/deny &;/' > /etc/nginx/conf.d/honeyfeed-deny.conf
nginx -t && nginx -s reload

How it's built

The honeypots log every connection, credential attempt, and command into a local database (5M+ attack records and counting). An hourly job selects IPs that crossed the repeat-offender threshold and attacked within the recency window, strips private ranges and benign scanners, and publishes the three files atomically. The same dataset feeds the live metrics on my homepage and my AbuseIPDB reporting.

Delisting & false positives

Think an IP is listed wrongly, or inherited an address that's on the list? Email me at jacob [at] jacobrakai.org with the IP and I'll check the logs and delist promptly if it doesn't hold up. Entries also age out on their own after 30 days without activity.

License & disclaimer

Released under CC0 1.0 — public domain, use it freely, no attribution required.

No warranty. The feed is provided as-is. Entries are honeypot-confirmed at the time of listing, but IP addresses get reassigned and some attackers use dynamic or shared addresses — verify before taking action on anything critical, and don't use this list as your only control.