We gratefully acknowledge IPinfo.io for their generous support of academic research by providing free access to their comprehensive IP geolocation and intelligence data.

Traffic Report for rynzs (US, San Jose)

Linux | 0.89 GB | hosting

Page loaded: 2025-12-19 09:45:52 UTC

Actionable Threat Intelligence

Firewall IP Blocklists
Choose Your Blocklist Strategy

Three different blocklist options are available based on your security requirements and tolerance for false positives.

Recommended
LightScope Network Power

Harnesses the power of the entire LightScope network! Contains IPs that connected to honeypots across ALL LightScope endpoints.

  • 🌐 Network-wide threat intelligence
  • ✓ 100% verified genuine attackers
  • ✓ No spoofed IP addresses
  • ✓ Maximum protection coverage
Best Choice: Leverages the collective intelligence of the entire LightScope network. Safe for immediate deployment.
Download Recommended
Conservative
Endpoint-Specific Verified

Only includes IPs that completed a 3-way TCP handshake with THIS endpoint's honeypot services. These are verified genuine threat actors specific to your endpoint.

  • ✓ Endpoint-specific targeting
  • ✓ Zero spoofing risk
  • ✓ Safe for production
  • ✓ Targeted protection
Good Choice: For endpoint-specific protection. These IPs specifically targeted your infrastructure.
Download Conservative
Extreme (Not Recommended)
All Threat Actor IPs

Includes ALL individual threat actor IPs that targeted your network, including those that may be spoofed by competitors or other attackers.

  • 🚨 HIGH spoofing probability
  • ⚠️ WILL LIKELY block legitimate traffic
  • ⚠️ Can cause service disruption
  • ⚠️ NOT RECOMMENDED
Not Recommended: High risk of blocking legitimate services. Only for isolated environments.
Download Extreme
Firewall Import Instructions:
pfSense/OPNsense:
Firewall → Aliases → IP → Upload
Cisco ASA:
object-group network BLOCKLIST
iptables:
ipset create blocklist hash:ip
Format:
Plain text, one IP per line

Automate your blocklist updates! Use these wget commands to automatically download the latest blocklists for integration into scripts, cron jobs, or automated security workflows.

Recommended (Network-wide)
wget -O recommended_blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/recommended"
Conservative (Endpoint-specific)
wget -O conservative_blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/conservative"
Extreme (Not Recommended)
wget -O extreme_blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/extreme"
Example Automation Script:
#!/bin/bash
# Download latest LightScope blocklist
wget -q -O /tmp/blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/recommended"

# Apply to iptables
ipset flush lightscope_blocklist
while read ip; do
  ipset add lightscope_blocklist $ip
done < /tmp/blocklist.txt
Cron Job Example:
# Update blocklist every hour
0 * * * * /usr/local/bin/update_blocklist.sh

# Update blocklist daily at 2 AM
0 2 * * * wget -q -O /etc/firewall/blocklist.txt \
  "https://lightscope.isi.edu/blocklist/20251004_pesszaxsjsanedtmkihqycumjrdaihwegcrtytwlpnrynzs/recommended" \
  && /usr/local/bin/reload_firewall.sh
Pro Tip: Set up automated downloads to keep your firewall protection current. The blocklists are updated whenever new dashboard data is processed, ensuring you have the latest threat intelligence.
Internal Threats
None detected
No unwanted traffic from internal IP addresses
Changes To Targeted Ports
No major changes detected
No port changes above 300%
Overall Traffic Trends
Normal Level
+0.6% change (7-day)
Current: 411,401
Previous: 409,127
Status:
  • Traffic levels are within normal range
  • Continue regular monitoring
  • Review other sections for insights
How to Use This Section

This section provides immediate, actionable insights from your threat intelligence data. Red items require immediate attention, yellow items need investigation, and green items indicate normal status. Click on the detailed sections below for comprehensive analysis and remediation steps.

Honeypot Analysis

IPs Connected to Honeypot Ports On Your Machine

Loading honeypot connections data...

Incomplete Connections: Attackers Started But Didn't Complete The 3-Way Handshake To Honeypot Ports

Loading incomplete connections data...

Honeypot Port Statistics

Loading port statistics...

Attack Payloads

Loading payload analysis...

Honeypot Attack Timeline

Loading temporal analysis...

General Information

All Sources Unwanted Traffic Port Activity
Last 7 Days
Daily Unwanted Traffic Since Inception
Weekly Unwanted Traffic by Hour
Last 7 Days
Ports Targeted by Unwanted Traffic
Last 7 Days
Data Time Ranges:
  • Weekly Unwanted Traffic by Hour: Last 7 days
  • Daily Unwanted Traffic Since Inception: Complete history
  • Port Statistics: Last 7 days
Unique Threat Actors

18,455

Distinct sources of unwanted traffic

Comparative Analysis
Unwanted Traffic Rankings
71.4% Unwanted Traffic Volume Percentile

Rank 13 of 42
among active endpoints for receiving unwanted traffic

226,802
Unwanted
Packets (7d)
12,768
Threat
Sources
16476
Targeted
Ports
Unwanted Traffic Concentration

Top threat subnets generate:

Top 5% of subnets (302 subnets): 88.7%
Top 10% of subnets: 93.2%
Top 20% of subnets: 95.9%
From 6,038 total threat subnets (226,788 unwanted packets)

Internal Threats

7-Day Comparison

Traffic Volume Changes
Current Week

411,401

packets

Previous Week

409,127

packets

Change

+2,274

(0.6%)

New Threat Actors
IP Address Hit Count Country ASN
143.198.60.26 3254 United States AS14061
104.156.155.8 2169 United States AS400161
62.60.135.171 2055 Iran AS59441
172.233.178.66 2013 United States AS63949
79.124.60.6 1941 Bulgaria AS50360
81.17.16.178 1824 Switzerland AS51852
79.124.56.6 1588 Bulgaria AS50360
139.199.80.137 1423 China AS45090
79.124.56.110 1385 Bulgaria AS50360
194.50.16.198 1328 Netherlands AS49870
New Subnets
Subnet Hit Count
79.124.49.0/24 13110
147.185.132.0/24 13092
Significant Activity Changes
IP Address Change Country
79.124.49.114 +73% Bulgaria
185.16.39.79 +68% Poland
102.213.28.195 -50% South Africa
87.120.191.65 +45% Netherlands
Port Targeting Changes
New Ports Being Targeted
Port 2222 (9839 hits) Port 3306 (3595 hits) Port 1080 (1439 hits) Port 445 (1360 hits) Port 3000 (1320 hits) Port 3128 (1136 hits) Port 8888 (925 hits) Port 8081 (913 hits) Port 8000 (908 hits) Port 6036 (842 hits)
Significant Port Changes
Port Change
23 +120%
443 +114%
80 +80%
8080 +74%
45634 +68%
8728 +64%
1433 +52%
8443 +50%
3389 +28%
New Geographic Sources
Iran (2055 hits) Switzerland (1824 hits) China (1423 hits) Romania (1034 hits) Canada (1030 hits)
Comparison Summary: This analysis compares the last 7 days with the previous 7 days (8-14 days ago). Traffic has increased by 2,274 packets (0.6%). 10 new threat actor(s) detected. 2 new subnet(s) detected.

Threat Intelligence Analysis

Unwanted Traffic by Company/Organization
Company/Organization Packet Count Unique Sources Countries ASNs Sample IPs
Capgemini Nederland B.V. 211,978 1 Netherlands AS16074 192.113.218.205
Contabo GmbH 121,026 4 Germany AS51167 82.208.21.194, 77.237.241.122, 84.247.188.191...
DigitalOcean, LLC 105,213 11 Germany Singapore United Kingdom +1 AS14061 134.199.196.58, 68.183.230.4, 134.199.204.151...
Tamatiya EOOD 24,793 19 Bulgaria AS50360 79.124.49.114, 79.124.56.6, 79.124.56.110...
Linode 19,929 81 United States AS63949 172.233.178.66, 45.79.163.53, 139.144.52.241...
Google LLC 17,711 115 Singapore United Kingdom United States AS396982 34.124.161.110, 162.216.150.168, 35.203.210.112...
OMAO SINGAPORE BOARDBAND 12,305 2 Singapore AS47741 202.155.148.50, 202.155.148.23
Fuse Hosting Web 10,526 3 Netherlands AS174 87.120.191.65, 87.120.191.81, 87.120.191.38
Palo Alto Networks, Inc 10,505 69 Belgium Brazil Finland +2 AS396982 147.185.132.178, 198.235.24.145, 147.185.133.146...
MEVSPACE sp. z o.o. 9,990 4 Poland AS201814 185.16.39.79, 95.214.53.196, 193.34.213.150...
Telkom Internet LTD 4,763 12 Netherlands AS210848 185.156.73.181, 92.63.197.145, 92.63.197.236...
Pfcloud UG 4,654 22 Germany Netherlands AS51396 176.65.148.168, 176.65.148.250, 176.65.148.229...
NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.) 3,863 2 Iran AS59441 62.60.135.171, 62.60.131.19
Department of E-Government 2,913 1 South Africa AS329220 102.213.28.195
Alsycon B.V. 2,737 1 Netherlands AS49870 194.50.16.198
Amazon Technologies Inc. 2,649 13 United States AS14618 AS16509 3.139.108.119, 3.138.204.93, 3.149.241.78...
Censys, Inc. 2,476 12 Germany United States AS398324 AS398705 206.168.34.46, 206.168.34.193, 167.94.146.53...
Alferov Aleksey Aleksandrovich 2,358 6 Russia Unknown 88.210.63.69, 88.210.63.191, 88.210.63.192...
Academy for Internet Research Limited Liability Company 2,169 1 United States AS400161 104.156.155.8
VenomDC - Private Internet Space. 1,941 1 Bulgaria AS50360 79.124.60.6
TECHOFF SRV LIMITED 1,922 3 Netherlands Romania AS47890 AS48090 80.94.92.12, 195.178.110.109, 45.148.10.115
Amazon Data Services France 1,850 2 France AS16509 13.37.248.113, 13.38.100.96
CLIENT4811 1,824 1 Switzerland AS51852 81.17.16.178
RECYBER PROJECT NETBLOCK 1,577 4 Netherlands AS202425 89.248.163.200, 89.248.163.181, 89.248.163.61...
FR ONYPHE 1,456 10 France United States AS213412 195.184.76.105, 91.196.152.17, 91.196.152.97...
Unwanted Traffic by Country
Country Country Code Packet Count Unique Sources Sample IPs
Netherlands NL 238,957 41 192.113.218.205, 87.120.191.65, 194.50.16.198, 87.120.191.81, 193.142.147.209
Germany DE 127,902 31 82.208.21.194, 185.91.127.107, 176.65.148.168, 77.237.241.122, 176.65.148.250
United States US 126,564 205 134.199.196.58, 134.199.204.151, 143.198.60.26, 172.233.178.66, 104.156.155.8
Singapore SG 31,362 6 68.183.230.4, 202.155.148.50, 34.124.161.110, 202.155.148.23, 36.255.98.221
Bulgaria BG 28,790 28 79.124.49.114, 79.124.60.6, 79.124.56.6, 79.124.56.110, 79.124.49.226
United Kingdom GB 11,123 61 157.245.32.173, 85.11.183.6, 35.203.210.112, 35.203.210.239, 35.203.210.55
Poland PL 10,839 7 185.16.39.79, 95.214.53.196, 194.180.48.63, 45.227.253.51, 193.34.213.150
China CN 6,491 12 139.199.80.137, 116.228.106.122, 117.70.74.242, 122.233.33.154, 114.55.236.5
Finland FI 6,114 40 147.185.133.146, 147.185.133.137, 147.185.133.136, 147.185.133.223, 147.185.133.162
Iran IR 4,085 3 62.60.135.171, 188.136.133.123, 62.60.131.19
Russia RU 3,864 12 88.210.63.69, 88.210.63.191, 88.210.63.192, 88.210.63.193, 178.22.24.121
France FR 3,005 10 13.37.248.113, 13.38.100.96, 91.196.152.17, 91.196.152.97, 91.231.89.250
South Africa ZA 2,913 1 102.213.28.195
Switzerland CH 2,326 2 81.17.16.178, 138.226.237.41
Romania RO 1,333 2 80.94.92.12, 80.94.95.221
Hong Kong HK 1,222 2 47.239.196.248, 52.128.247.26
Canada CA 1,030 1 103.102.230.4
Lithuania LT 969 2 141.98.11.140, 77.90.185.84
Belgium BE 937 6 198.235.24.145, 198.235.24.131, 198.235.24.139, 198.235.24.155, 198.235.24.135
Taiwan TW 811 5 203.67.99.229, 198.235.24.20, 198.235.24.33, 198.235.24.10, 198.235.24.14
Japan JP 638 1 185.244.104.2
Turkey TR 635 4 178.20.210.152, 178.20.210.151, 178.20.210.159, 45.141.233.45
India IN 564 3 128.185.220.90, 122.187.228.233, 161.248.218.190
Egypt EG 382 2 196.219.143.75, 41.40.9.190
Spain ES 327 2 5.187.35.158, 5.187.35.54
Unwanted Traffic by Autonomous System (ASN)
ASN AS Name Packet Count Unique Sources Countries Sample IPs
AS16074 Capgemini Nederland B.V. 211,978 1 Netherlands 192.113.218.205
AS51167 Contabo GmbH 121,026 4 Germany 82.208.21.194, 77.237.241.122, 84.247.188.191...
AS14061 DigitalOcean, LLC 105,213 11 Germany Singapore United Kingdom +1 134.199.196.58, 68.183.230.4, 134.199.204.151...
AS396982 Google LLC 28,216 184 Belgium Brazil Finland +4 34.124.161.110, 162.216.150.168, 35.203.210.112...
AS50360 Tamatiya EOOD 26,734 20 Bulgaria 79.124.49.114, 79.124.60.6, 79.124.56.6...
AS63949 Akamai Connected Cloud 19,929 81 United States 172.233.178.66, 45.79.163.53, 139.144.52.241...
AS47741 TSUNAMI ELECTRIC LIMITED 12,305 2 Singapore 202.155.148.50, 202.155.148.23
AS201814 MEVSPACE sp. z o.o. 10,567 6 Poland 185.16.39.79, 95.214.53.196, 194.180.48.63...
AS174 Cogent Communications 10,526 3 Netherlands 87.120.191.65, 87.120.191.81, 87.120.191.38
Unknown Unknown 6,246 15 Bulgaria Canada Denmark +5 103.102.230.4, 45.156.87.74, 85.11.183.6...
AS210848 Telkom Internet LTD 4,763 12 Netherlands 185.156.73.181, 92.63.197.145, 92.63.197.236...
AS51396 Pfcloud UG 4,654 22 Germany Netherlands 176.65.148.168, 176.65.148.250, 176.65.148.229...
AS16509 Amazon.com, Inc. 4,270 14 France United States 13.37.248.113, 13.38.100.96, 3.139.108.119...
AS59441 Hostiran Network 3,863 2 Iran 62.60.135.171, 62.60.131.19
AS202425 IP Volume inc 3,048 8 Netherlands 80.82.77.144, 89.248.163.200, 89.248.163.181...
AS49870 Alsycon B.V. 2,922 2 Netherlands 194.50.16.198, 45.140.222.66
AS329220 Department of E-Government 2,913 1 South Africa 102.213.28.195
AS4134 CHINANET-BACKBONE 2,203 4 China 117.70.74.242, 122.233.33.154, 122.245.143.18...
AS400161 Academy for Internet Research Limited Liability Company 2,169 1 United States 104.156.155.8
AS398324 Censys, Inc. 2,099 10 United States 206.168.34.46, 206.168.34.193, 206.168.34.118...
AS51852 Private Layer INC 1,824 1 Switzerland 81.17.16.178
AS213412 ONYPHE SAS 1,456 10 France United States 195.184.76.105, 91.196.152.17, 91.196.152.97...
AS45090 Shenzhen Tencent Computer Systems Company Limited 1,423 1 China 139.199.80.137
AS49581 Ferdinand Zink trading as Tube-Hosting 1,262 1 Germany 185.91.127.107
AS214943 Railnet LLC 1,222 3 Netherlands Turkey 213.209.143.82, 213.209.143.73, 45.141.233.45

Global Threat Intelligence

Global Threat Trends
Network-Wide Traffic Volume
Recent 30 days
17,871,221
Previous 30 days
16,682,973
+7.1% change
Unique Threat Sources
Recent 30 days
73,271
Previous 30 days
78,183
-6.3% change
Top Threat Source Countries
Country Packets Sources
United States 3,980,080 167
France 1,719,916 10
Canada 1,505,133 21
Germany 1,502,932 51
Netherlands 911,039 70
Top Targeted Ports Globally
Port Hit Count Sources
5900 4,094,119 2348
3306 1,868,525 3187
2222 518,447 5953
1080 373,220 1757
8728 304,737 435
New Threat Subnets (Last 7 Days)
Subnet First Seen Packets Endpoints Country Organization Sample IPs
203.23.128.0/24 2025-12-17T19:11:26 38 1 Hong Kong BrainStorm Network, Inc 203.23.128.218
78.184.97.0/24 2025-12-17T19:12:44 1 1 Turkey TT ADSL-TTnet_dynamic_gay 78.184.97.59
180.154.62.0/24 2025-12-17T19:12:40 1 1 China CHINANET SHANGHAI PROVINCE NETWORK 180.154.62.130
14.19.130.0/24 2025-12-17T19:12:30 1 1 China CHINANET Guangdong province network 14.19.130.47
186.48.91.0/24 2025-12-17T19:12:21 1 1 Uruguay Administracion Nacional de Telecomunicaciones 186.48.91.110
191.36.215.0/24 2025-12-17T19:11:45 1 1 Brazil Brconecta LTDA 191.36.215.192
45.56.109.0/24 2025-12-17T19:10:37 1 1 United States Linode 45.56.109.244

Coordinated Attack Patterns (Sharded Subnets)

Subnets in Coordinated Group:
79.221.233.0/24 231.70.51.0/24 91.224.92.0/24 62.6.249.0/24 134.199.196.0/24 251.75.253.0/24 143.110.223.0/24 165.227.47.0/24 134.199.203.0/24 143.198.44.0/24 129.212.185.0/24 35.40.64.0/24 143.198.239.0/24 159.203.39.0/24 165.22.233.0/24 79.124.56.0/24 162.243.248.0/24 2.237.187.0/24 192.113.218.0/24 87.120.191.0/24 167.94.138.0/24 35.203.211.0/24 87.133.135.0/24 147.185.133.0/24 162.216.149.0/24 162.216.150.0/24 207.90.244.0/24 162.199.20.0/24 129.212.188.0/24 35.203.210.0/24 147.185.132.0/24 115.74.211.0/24 79.124.49.0/24 198.235.24.0/24 159.89.225.0/24 129.212.181.0/24 143.110.210.0/24 129.64.177.0/24 205.210.31.0/24 79.124.62.0/24 55.236.236.0/24 82.208.21.0/24 78.128.114.0/24 142.214.101.0/24 88.26.109.0/24 52.154.143.0/24 206.168.34.0/24 77.169.208.0/24 193.163.125.0/24 129.212.179.0/24 162.142.125.0/24 165.232.156.0/24 167.94.146.0/24 249.112.182.0/24 198.245.9.0/24 185.16.39.0/24 195.184.76.0/24 91.231.89.0/24 176.65.149.0/24 120.247.7.0/24 216.180.246.0/24 133.89.7.0/24 109.205.211.0/24 79.124.40.0/24 92.63.197.0/24 113.39.106.0/24 134.199.204.0/24 213.199.75.0/24 176.65.148.0/24 62.60.135.0/24 194.50.16.0/24 88.210.63.0/24 185.156.73.0/24 172.105.147.0/24 144.86.173.0/24 196.15.219.0/24 68.183.149.0/24 165.227.43.0/24 137.184.121.0/24 146.190.253.0/24 68.183.230.0/24 147.182.155.0/24 165.227.41.0/24 159.89.117.0/24 206.189.180.0/24 107.170.3.0/24 134.199.202.0/24 134.199.197.0/24 165.22.130.0/24 165.22.16.0/24 64.23.175.0/24 45.9.229.0/24 159.195.61.0/24 143.198.60.0/24
Detected Coordination Patterns:
Traffic Timeline - Coordinated Patterns:
This chart shows hourly traffic patterns for all subnets in this coordinated group. Look for synchronized increases/decreases that indicate coordinated behavior.
Unwanted Traffic Temporal Analysis:
This scatter plot shows detailed port targeting activity over time for all subnets in this coordinated group. Each bubble represents port activity - larger bubbles indicate higher packet volumes.

Individual Threat Actors

Location Information
Country:Germany (DE)
City:Düsseldorf
Region:North Rhine-Westphalia
Postal Code:40210
Timezone:Europe/Berlin
Network Information
ASN:AS51167
AS Name:Contabo GmbH
Company:Contabo GmbH
Domain:contabo.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 32% (Low Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
ludbp (86,843 hits)
Temporal Port Activity
Last 7 Days
xqtiq (654 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:United States (US)
City:Lithia Springs
Region:Georgia
Postal Code:30122
Timezone:America/New_York
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 100% (High Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
fqsso (111,647 hits)
Temporal Port Activity
Last 7 Days
nqatp (74,518 hits)
Temporal Port Activity
Last 7 Days
vqhav (73,522 hits)
Temporal Port Activity
Last 7 Days
iafdz (63,723 hits)
Temporal Port Activity
Last 7 Days
qffay (62,539 hits)
Temporal Port Activity
Last 7 Days
isxku (61,053 hits)
Temporal Port Activity
Last 7 Days
crwvg (59,574 hits)
Temporal Port Activity
Last 7 Days
mrozu (58,309 hits)
Temporal Port Activity
Last 7 Days
deoyg (58,033 hits)
Temporal Port Activity
Last 7 Days
eanhc (51,044 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:Singapore (SG)
City:Singapore
Region:
Postal Code:574180
Timezone:Asia/Singapore
Network Information
ASN:AS47741
AS Name:TSUNAMI ELECTRIC LIMITED
Company:OMAO SINGAPORE BOARDBAND
Domain:omao.ee
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 0% (Clean)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
Location Information
Country:Bulgaria (BG)
City:Sofia
Region:Sofia-Capital
Postal Code:1000
Timezone:Europe/Sofia
Network Information
ASN:AS50360
AS Name:Tamatiya EOOD
Company:Tamatiya EOOD
Domain:4vendeta.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 54% (Medium Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
vqhav (10,825 hits)
Temporal Port Activity
Last 7 Days
crwvg (10,129 hits)
Temporal Port Activity
Last 7 Days
nqatp (10,063 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:Singapore (SG)
City:Singapore
Region:
Postal Code:627753
Timezone:Asia/Singapore
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 100% (High Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
eanhc (24,003 hits)
Temporal Port Activity
Last 7 Days
iafdz (23,155 hits)
Temporal Port Activity
Last 7 Days
isxku (21,205 hits)
Temporal Port Activity
Last 7 Days
deoyg (21,022 hits)
Temporal Port Activity
Last 7 Days
mrozu (20,961 hits)
Temporal Port Activity
Last 7 Days
tgcua (19,827 hits)
Temporal Port Activity
Last 7 Days
alzae (18,636 hits)
Temporal Port Activity
Last 7 Days
sqepx (16,534 hits)
Temporal Port Activity
Last 7 Days
ludbp (14,656 hits)
Temporal Port Activity
Last 7 Days
xqtiq (6,122 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:United States (US)
City:Lithia Springs
Region:Georgia
Postal Code:30122
Timezone:America/New_York
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 100% (High Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
isxku (18,002 hits)
Temporal Port Activity
Last 7 Days
deoyg (17,304 hits)
Temporal Port Activity
Last 7 Days
xqtiq (16,416 hits)
Temporal Port Activity
Last 7 Days
ludbp (7,651 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:Poland (PL)
City:Warsaw
Region:Mazovia
Postal Code:00-002
Timezone:Europe/Warsaw
Network Information
ASN:AS201814
AS Name:MEVSPACE sp. z o.o.
Company:MEVSPACE sp. z o.o.
Domain:mevspace.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 100% (High Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
vzrsr (10,884 hits)
Temporal Port Activity
Last 7 Days
qffay (10,273 hits)
Temporal Port Activity
Last 7 Days
deoyg (10,132 hits)
Temporal Port Activity
Last 7 Days
eanhc (8,971 hits)
Temporal Port Activity
Last 7 Days
alzae (8,636 hits)
Temporal Port Activity
Last 7 Days
xqtiq (6,578 hits)
Temporal Port Activity
Last 7 Days
oxrwe (2,655 hits)
Temporal Port Activity
Last 7 Days
mrozu (1 hits)
Temporal Port Activity
Last 7 Days
fqsso (1 hits)
Temporal Port Activity
Last 7 Days
amrza (1 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:Netherlands (NL)
City:Lelystad
Region:Flevoland
Postal Code:8224
Timezone:Europe/Amsterdam
Network Information
ASN:AS174
AS Name:Cogent Communications
Company:Fuse Hosting Web
Domain:fusehosting.net
Privacy Information
Hosting:Unknown
Proxy:Unknown
VPN:Unknown
Tor:Unknown
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 100% (High Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
oxrwe (25,748 hits)
Temporal Port Activity
Last 7 Days
iafdz (13,636 hits)
Temporal Port Activity
Last 7 Days
qffay (12,614 hits)
Temporal Port Activity
Last 7 Days
isxku (11,848 hits)
Temporal Port Activity
Last 7 Days
nqatp (10,983 hits)
Temporal Port Activity
Last 7 Days
mrozu (10,780 hits)
Temporal Port Activity
Last 7 Days
deoyg (10,709 hits)
Temporal Port Activity
Last 7 Days
vqhav (10,512 hits)
Temporal Port Activity
Last 7 Days
sqepx (9,444 hits)
Temporal Port Activity
Last 7 Days
crwvg (9,133 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:United States (US)
City:Santa Clara
Region:California
Postal Code:95054
Timezone:America/Los_Angeles
Network Information
ASN:AS14061
AS Name:DigitalOcean, LLC
Company:DigitalOcean, LLC
Domain:digitalocean.com
Privacy Information
Hosting:true
Proxy:
VPN:
Tor:
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 45% (Low Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
nqatp (8,465 hits)
Temporal Port Activity
Last 7 Days
iafdz (7,808 hits)
Temporal Port Activity
Last 7 Days
mrozu (7,173 hits)
Temporal Port Activity
Last 7 Days
tgcua (7,128 hits)
Temporal Port Activity
Last 7 Days
vqhav (6,957 hits)
Temporal Port Activity
Last 7 Days
eanhc (5,986 hits)
Temporal Port Activity
Last 7 Days
sqepx (5,925 hits)
Temporal Port Activity
Last 7 Days
alzae (4,418 hits)
Temporal Port Activity
Last 7 Days
ludbp (4,013 hits)
Temporal Port Activity
Last 7 Days
crwvg (1,919 hits)
Temporal Port Activity
Last 7 Days
Location Information
Country:United States (US)
City:Los Angeles
Region:California
Postal Code:90009
Timezone:America/Los_Angeles
Network Information
ASN:AS400161
AS Name:Academy for Internet Research Limited Liability Company
Company:Academy for Internet Research Limited Liability Company
Domain:academyforinternetresearch.org
Privacy Information
Hosting:Unknown
Proxy:Unknown
VPN:Unknown
Tor:Unknown
AbuseIPDB Information
Abuse Confidence Score: AbuseIPDB 100% (High Risk)
rynzs - Targeted Ports
Temporal Port Activity
Last 7 Days
yrhma (1,464 hits)
Temporal Port Activity
Last 7 Days
zudmg (1,464 hits)
Temporal Port Activity
Last 7 Days
exbxm (1,464 hits)
Temporal Port Activity
Last 7 Days
khymv (1,464 hits)
Temporal Port Activity
Last 7 Days
xqtiq (1,463 hits)
Temporal Port Activity
Last 7 Days
ekxie (1,463 hits)
Temporal Port Activity
Last 7 Days
tnrte (1,463 hits)
Temporal Port Activity
Last 7 Days
asubn (1,463 hits)
Temporal Port Activity
Last 7 Days
xcxaf (1,460 hits)
Temporal Port Activity
Last 7 Days
fqsso (625 hits)
Temporal Port Activity
Last 7 Days

Subnet Analysis (/24 Networks)

Unique Subnets

9,792

Distinct /24 networks with unwanted traffic

Ports Targeted by Subnets
Last 7 Days
Subnet Temporal Port Activity
Last 7 Days
Top Subnet Offenders
IPs in Subnet
IP Address Hit Count
82.208.21.194 57,002
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
134.199.196.58 28,781
134.199.196.0 2
134.199.196.142 2
134.199.196.250 2
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
147.185.133.146 199
147.185.133.137 194
147.185.133.136 193
147.185.133.223 191
147.185.133.162 187
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
162.216.149.73 235
162.216.149.77 213
162.216.149.170 209
162.216.149.180 183
162.216.149.158 182
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
162.216.150.168 246
162.216.150.184 207
162.216.150.122 194
162.216.150.239 185
162.216.150.77 171
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
35.203.210.112 240
35.203.210.239 207
35.203.210.55 206
35.203.210.138 189
35.203.210.98 178
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
35.203.211.238 198
35.203.211.71 186
35.203.211.219 184
35.203.211.39 181
35.203.211.168 176
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
79.124.49.114 11,343
79.124.49.226 1,300
79.124.49.230 404
79.124.49.90 33
79.124.49.134 14
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
147.185.132.178 227
147.185.132.122 171
147.185.132.158 171
147.185.132.221 160
147.185.132.35 160
Ports Targeted by This Subnet
Temporal Port Activity
IPs in Subnet
IP Address Hit Count
202.155.148.50 12,145
202.155.148.23 160
Ports Targeted by This Subnet
Temporal Port Activity
Complete Endpoint Data Export
Download All LightScope Data For This Endpoint

Get the complete raw dataset for this endpoint in CSV format. This includes all network traffic data, timestamps, IP addresses, ports, and other collected intelligence from the lightscope_honeypot_included_data table.

  • Format: CSV (Comma-Separated Values)
  • Contents: All endpoint data ordered by most recent first
  • Use Case: Research, analysis, custom reporting, data science
  • Compatibility: Excel, Python pandas, R, SQL imports
Download All Data
CSV format
Note: This download contains the raw data used to generate all dashboard visualizations and analytics. File size depends on the amount of traffic data collected for this endpoint.