Deutsch

Honeypot64 – Statistics overview

Many small Node64 sensors report attacks to IPv64.net. From these reports we build the v64 Blocklist and lists of attacker passwords, usernames, user agents and paths – free for everyone as a first line of defense.

Rankings and lists only contain entries reported by at least 2 independent accounts in the last 30 days; e-mail addresses, random strings and control characters are removed. Full statistics (top 100, newly listed IPs, new paths, search, export): logged in with all plans except Standard.

Contribute yourself: enable Honeypot64 in Node64 (guide at node64.de/docs/honeypot/), your sensors at /honeypot/. Contributors get the live lists. · Check an IP: /honeypot/ip.php

Active sensors (7 days)

3 / 1 online

Contributing accounts (7 days)

1

Attacks 24 h

0

Attacker IPs 24 h

0

v64 Blocklist (live)

0

Attacks per day (30 days, UTC)
Most attacked ports (7 days)
Kinds (7 days)
sip:scan25,370
sip:bruteforce20,362
generic:probe20,089
ssh:bruteforce9,664
telnet:bruteforce6,063
db:bruteforce5,730
http:scan2,743
http:exploit629
mail:auth-bruteforce164
http:exploit:upload154
Origin by country (IPs on the v64 Blocklist seen in the last 30 days)

No data yet.

Lists – free, license CC BY 4.0, provided as is
v64 Blocklist (IPs, daily list free, live list for contributors and plans from VIP) 0
SSH/Telnet 0 · Web 0 · Mail 0 · RDP 0 · Scanner 0 · Research 0
ipv64_passwords.txt · ipv64_passwords_sha1.txt 0
ipv64_usernames.txt 0
ipv64_bad_useragents.txt · ipv64_bad_useragents.nginx.map 0
ipv64_attack_paths.txt · ipv64_attack_paths.nginx.conf 0

Password/username lists every 6 hours, one entry per line (most used first). All lists with count and update: index.json

Top 10 Usernames (30 days)

No entries above the threshold yet.

Top 10 Passwords (30 days)

No entries above the threshold yet.

Top 10 Paths (30 days)

No entries above the threshold yet.

Top 10 User-Agents (30 days)

No entries above the threshold yet.

Top 10 Fingerprints (JA4/HASSH) (30 days)

No entries above the threshold yet.

Node64Node64
Join in: Honeypot64 is a module of Node64, the homelab container by ipv64.net.
More about Node64

As of 2026-10-26 19:15 (refreshed at most every 10 minutes). Only statistics and rated lists are published; sensor IPs and reporting accounts stay internal. API: GET https://ipv64.net/api/v2/threat/stats