We gratefully acknowledge IPinfo.io for their generous support of academic research by providing free access to their comprehensive IP geolocation and intelligence data.

Traffic Report for rynzs (US, San Jose)

Linux | 0.89 GB | hosting

Page loaded: 2026-04-02 14:26:28 UTC

Actionable Threat Intelligence

Firewall IP Blocklists
Choose Your Blocklist Strategy

Three different blocklist options are available based on your security requirements and tolerance for false positives.

Recommended
LightScope Network Power

Harnesses the power of the entire LightScope network! Contains IPs that connected to honeypots across ALL LightScope endpoints.

  • 🌐 Network-wide threat intelligence
  • ✓ 100% verified genuine attackers
  • ✓ No spoofed IP addresses
  • ✓ Maximum protection coverage
Best Choice: Leverages the collective intelligence of the entire LightScope network. Safe for immediate deployment.
Download Recommended
Conservative
Endpoint-Specific Verified

Only includes IPs that completed a 3-way TCP handshake with THIS endpoint's honeypot services. These are verified genuine threat actors specific to your endpoint.

  • ✓ Endpoint-specific targeting
  • ✓ Zero spoofing risk
  • ✓ Safe for production
  • ✓ Targeted protection
Good Choice: For endpoint-specific protection. These IPs specifically targeted your infrastructure.
Download Conservative
Extreme (Not Recommended)
All Threat Actor IPs

Includes ALL individual threat actor IPs that targeted your network, including those that may be spoofed by competitors or other attackers.

  • 🚨 HIGH spoofing probability
  • ⚠️ WILL LIKELY block legitimate traffic
  • ⚠️ Can cause service disruption
  • ⚠️ NOT RECOMMENDED
Not Recommended: High risk of blocking legitimate services. Only for isolated environments.
Download Extreme
Firewall Import Instructions:
pfSense/OPNsense:
Firewall → Aliases → IP → Upload
Cisco ASA:
object-group network BLOCKLIST
iptables:
ipset create blocklist hash:ip
Format:
Plain text, one IP per line

Automate your blocklist updates! Use these wget commands to automatically download the latest blocklists for integration into scripts, cron jobs, or automated security workflows.

Recommended (Network-wide)
wget -O recommended_blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/recommended"
Conservative (Endpoint-specific)
wget -O conservative_blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/conservative"
Extreme (Not Recommended)
wget -O extreme_blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/extreme"
Example Automation Script:
#!/bin/bash
# Download latest LightScope blocklist
wget -q -O /tmp/blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/recommended"

# Apply to iptables
ipset flush lightscope_blocklist
while read ip; do
  ipset add lightscope_blocklist $ip
done < /tmp/blocklist.txt
Cron Job Example:
# Update blocklist every hour
0 * * * * /usr/local/bin/update_blocklist.sh

# Update blocklist daily at 2 AM
0 2 * * * wget -q -O /etc/firewall/blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/recommended" \
  && /usr/local/bin/reload_firewall.sh
Pro Tip: Set up automated downloads to keep your firewall protection current. The blocklists are updated whenever new dashboard data is processed, ensuring you have the latest threat intelligence.
Internal Threats
None detected
No unwanted traffic from internal IP addresses
Changes To Targeted Ports
No major changes detected
No port changes above 300%
Overall Traffic Trends
Unknown Level
0.0% change (7-day)
Status:
  • Traffic levels are within normal range
  • Continue regular monitoring
  • Review other sections for insights
How to Use This Section

This section provides immediate, actionable insights from your threat intelligence data. Red items require immediate attention, yellow items need investigation, and green items indicate normal status. Click on the detailed sections below for comprehensive analysis and remediation steps.

Honeypot Analysis

IPs Connected to Honeypot Ports On Your Machine

Loading honeypot connections data...

Incomplete Connections: Attackers Started But Didn't Complete The 3-Way Handshake To Honeypot Ports

Loading incomplete connections data...

Honeypot Port Statistics

Loading port statistics...

Captured Commands

Loading payload analysis...

Honeypot Attack Timeline

Loading temporal analysis...

General Information

All Sources Unwanted Traffic Port Activity
Last 7 Days
Daily Unwanted Traffic Since Inception
Weekly Unwanted Traffic by Hour
Last 7 Days
Ports Targeted by Unwanted Traffic
Last 7 Days
Data Time Ranges:
  • Weekly Unwanted Traffic by Hour: Last 7 days
  • Daily Unwanted Traffic Since Inception: Complete history
  • Port Statistics: Last 7 days
Unique Threat Actors

14,026

Distinct sources of unwanted traffic

Comparative Analysis
Unwanted Traffic Concentration

Top threat subnets generate:

Top 5% of subnets (315 subnets): 83.4%
Top 10% of subnets: 88.4%
Top 20% of subnets: 92.8%
From 6,292 total threat subnets (175,273 unwanted packets)

Internal Threats

Threat Intelligence Analysis

Unwanted Traffic by Company/Organization
No company traffic data available
Unwanted Traffic by Country
No country traffic data available
Unwanted Traffic by Autonomous System (ASN)
No ASN traffic data available

Global Threat Intelligence

Global Threat Trends
Network-Wide Traffic Volume
Recent 30 days
0
Previous 30 days
0
0.0% change
Unique Threat Sources
Recent 30 days
0
Previous 30 days
0
0.0% change
Top Threat Source Countries
Country Packets Sources
Top Targeted Ports Globally
Port Hit Count Sources

Individual Threat Actors

Location Information
Country:United States (US)
City:North Bergen
Region:New Jersey
Postal Code:07047
Timezone:America/New_York
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:United States (US)
City:Broomfield
Region:Colorado
Postal Code:80021
Timezone:America/Denver
Network Information
ASN:Unknown
AS Name:Unknown
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:Netherlands (NL)
City:Amsterdam
Region:North Holland
Postal Code:1012
Timezone:Europe/Amsterdam
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:true
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:United States (US)
City:Secaucus
Region:New Jersey
Postal Code:07094
Timezone:America/New_York
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:Portugal (PT)
City:Vila Nova de Gaia
Region:Porto
Postal Code:4400-000
Timezone:Europe/Lisbon
Network Information
ASN:AS42863
AS Name:MEO - SERVICOS DE COMUNICACOES E MULTIMEDIA S.A.
Company:MEO Mobile Enterprise Customers
Domain:meo.pt
Privacy Information
Hosting:Unknown
Proxy:Unknown
VPN:Unknown
Tor:Unknown
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:Netherlands (NL)
City:Amsterdam
Region:North Holland
Postal Code:1012
Timezone:Europe/Amsterdam
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:Poland (PL)
City:Warsaw
Region:Mazovia
Postal Code:00-002
Timezone:Europe/Warsaw
Network Information
ASN:AS201814
AS Name:MEVSPACE sp. z o.o.
Company:MEVSPACE sp. z o.o.
Domain:mevspace.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:Netherlands (NL)
City:Haarlem
Region:North Holland
Postal Code:2031
Timezone:Europe/Amsterdam
Network Information
ASN:AS20473
AS Name:The Constant Company, LLC
Company:Vultr Holdings, LLC
Domain:vultr.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:Bulgaria (BG)
City:Sofia
Region:Sofia-Capital
Postal Code:1000
Timezone:Europe/Sofia
Network Information
ASN:AS202325
AS Name:4Media Ltd.
Company:VPS and Shared Hosting pool
Domain:dotdash.host
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:United States (US)
City:North Bergen
Region:New Jersey
Postal Code:07047
Timezone:America/New_York
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days

Subnet Analysis (/24 Networks)

Unique Subnets

6,292

Distinct /24 networks with unwanted traffic

Ports Targeted by Subnets
Last 7 Days
Subnet Temporal Port Activity
Last 7 Days
Top Subnet Offenders
IPs in Subnet
IP Address Hit Count
159.89.84.85 12,989
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
147.185.133.159 41
147.185.133.188 38
147.185.133.92 38
147.185.133.31 37
147.185.133.174 36
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
162.216.150.122 40
162.216.150.64 40
162.216.150.142 39
162.216.150.167 39
162.216.150.177 39
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
129.212.184.194 6,411
129.212.184.242 3
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
162.216.149.241 39
162.216.149.198 37
162.216.149.31 36
162.216.149.34 36
162.216.149.70 36
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
35.203.211.208 48
35.203.211.136 37
35.203.211.100 36
35.203.211.46 36
35.203.211.68 36
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
35.203.210.10 44
35.203.210.167 41
35.203.210.230 38
35.203.210.136 37
35.203.210.25 37
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
185.242.226.44 476
185.242.226.42 396
185.242.226.3 389
185.242.226.22 384
185.242.226.12 383
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
147.185.132.20 38
147.185.132.176 37
147.185.132.44 37
147.185.132.206 35
147.185.132.241 35
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
68.183.5.151 4,005
68.183.5.216 1
Ports Targeted by This Subnet
Temporal Port Activity
Complete Endpoint Data Export
Download All LightScope Data For This Endpoint

Get the complete raw dataset for this endpoint in CSV format. This includes all network traffic data, timestamps, IP addresses, ports, and other collected intelligence from the lightscope_honeypot_included_data table.

  • Format: CSV (Comma-Separated Values)
  • Contents: All endpoint data ordered by most recent first
  • Use Case: Research, analysis, custom reporting, data science
  • Compatibility: Excel, Python pandas, R, SQL imports
Download All Data
CSV format
Note: This download contains the raw data used to generate all dashboard visualizations and analytics. File size depends on the amount of traffic data collected for this endpoint.