Honeypot64 – Statistics overview
Many small Node64 sensors report attacks to IPv64.net. From these reports we build the v64 Blocklist and lists of attacker passwords, usernames, user agents and paths – free for everyone as a first line of defense.
Rankings and lists only contain entries reported by at least 3 independent accounts in the last 30 days; e-mail addresses, random strings and control characters are removed. Full statistics (top 100, newly listed IPs, new paths, search, export): logged in with all plans except Standard.
Active sensors (7 days)
53 / 42 online
Contributing accounts (7 days)
38
Attacks 24 h
3,224,588
Attacker IPs 24 h
15,344
v64 Blocklist (live)
5,946
32 % only here, on no other blocklist
generic:probe | 9,820,374 |
db:bruteforce | 5,887,663 |
vnc:bruteforce | 837,536 |
ssh:bruteforce | 744,691 |
sip:scan | 513,378 |
http:scan | 503,584 |
sip:bruteforce | 430,559 |
telnet:bruteforce | 394,646 |
http:exploit | 341,574 |
http:exploit:traversal | 70,275 |
| # | Country | IPs | Events | |
|---|---|---|---|---|
| 1 | 🇬🇧 United Kingdom GB | 1,802 | 53,012 | |
| 2 | 🇺🇸 United States US | 1,777 | 360,089 | |
| 3 | 🇩🇪 Germany DE | 491 | 215,626 | |
| 4 | 🇧🇪 Belgium BE | 251 | 46,922 | |
| 5 | 🇳🇱 Netherlands NL | 221 | 156,347 | |
| 6 | 🇨🇳 China CN | 190 | 36,959 | |
| 7 | 🇮🇷 Iran IR | 163 | 10,219 | |
| 8 | 🇫🇷 France FR | 95 | 174,061 | |
| 9 | 🇰🇷 South Korea KR | 89 | 9,530 | |
| 10 | 🇧🇷 Brazil BR | 88 | 5,660 |
IP country data: DB-IP.com
| v64 Blocklist (IPs, daily list free, live list for contributors and plans from VIP) | 5,946 |
| ipv64_passwords.txt · ipv64_passwords_sha1.txt | 10,000 |
| ipv64_usernames.txt | 10,000 |
| ipv64_bad_useragents.txt · ipv64_bad_useragents.nginx.map | 398 |
| ipv64_attack_paths.txt · ipv64_attack_paths.nginx.conf | 4,209 |
Password/username lists every 6 hours, one entry per line (most used first). All lists with count and update: index.json
| # | Value | Events | Accounts |
|---|---|---|---|
| 1 | sa | 5,660,445 | 10 |
| 2 | root | 624,166 | 13 |
| 3 | admin | 119,526 | 19 |
| 4 | enable | 36,724 | 8 |
| 5 | devel | 22,612 | 7 |
| 6 | system | 21,715 | 8 |
| 7 | ubuntu | 21,689 | 8 |
| 8 | user | 16,107 | 12 |
| 9 | probe | 10,948 | 9 |
| 10 | postgres | 10,355 | 9 |
| # | Value | Events | Accounts |
|---|---|---|---|
| 1 | 123456 | 61,622 | 11 |
| 2 | 1234 | 35,064 | 10 |
| 3 | 123 | 34,870 | 9 |
| 4 | admin | 30,851 | 19 |
| 5 | password | 29,447 | 11 |
| 6 | 12345 | 27,173 | 9 |
| 7 | linuxshell | 24,418 | 8 |
| 8 | root | 23,818 | 11 |
| 9 | 1 | 22,764 | 10 |
| 10 | shell | 20,260 | 8 |
| # | Value | Events | Accounts |
|---|---|---|---|
| 1 | /login | 7,474 | 19 |
| 2 | /.git/config | 3,810 | 24 |
| 3 | /.env | 3,702 | 24 |
| 4 | /graphql | 3,339 | 18 |
| 5 | /.env.production | 2,783 | 23 |
| 6 | /.env.local | 2,757 | 23 |
| 7 | /.env.backup | 2,578 | 23 |
| 8 | /api/.env | 2,555 | 23 |
| 9 | /.env.dev | 2,527 | 23 |
| 10 | /.env.bak | 2,517 | 23 |
| # | Value | Events | Accounts |
|---|---|---|---|
| 1 | VOIP | 222,080 | 7 |
| 2 | pplsip | 55,521 | 5 |
| 3 | Z 3.14.38765 rv2.8.3 | 46,367 | 5 |
| 4 | PBX | 45,948 | 7 |
| 5 | Linksys-SPA942 | 42,133 | 7 |
| 6 | Linphone/3.12.0 (eXosip2/4.1.0) | 25,944 | 5 |
| 7 | Bria 3 release 3.5.5 stamp 71243 | 25,923 | 5 |
| 8 | Zoiper rv2.10.11 | 25,825 | 5 |
| 9 | Yealink SIP-T46G 28.73.0.40 | 25,734 | 5 |
| 10 | Grandstream GXP2130 1.0.5.23 | 25,601 | 5 |
| # | Value | Events | Accounts |
|---|---|---|---|
| 1 | hassh:98f63c4d9c87edbd97ed4747fa031019 | 217,803 | 8 |
| 2 | hassh:0a07365cc01fa9fc82608ba4019af499 | 204,849 | 8 |
| 3 | hassh:16443846184eafde36765c9bab2f4397 | 97,494 | 8 |
| 4 | hassh:98ddc5604ef6a1006a2b49a58759fbe6 | 29,457 | 6 |
| 5 | hassh:2a86d5946159539cb26c1657f9c447f2 | 28,855 | 4 |
| 6 | hassh:5bd26477da5440a6187bd3f1b39a429c | 26,331 | 7 |
| 7 | hassh:19532158b559096b89b1a5f7d17175b2 | 21,277 | 7 |
| 8 | hassh:f555226df1963d1d3c09daf865abdc9a | 18,225 | 5 |
| 9 | hassh:2ec37a7cc8daf20b10e1ad6221061ca5 | 11,822 | 7 |
| 10 | hassh:acaa53e0a7d7ac7d1255103f37901306 | 9,953 | 4 |
As of 2026-11-04 19:27 (refreshed at most every 10 minutes).
Only statistics and rated lists are published; sensor IPs and reporting accounts stay internal. API: GET https://ipv64.net/api/v2/threat/stats