SSH Honeypot Intelligence
HoneySEC
Open blacklist intelligence from distributed honeypot telemetry, designed for operators who need a clean corporate-grade security feed.
HoneySEC Platform
Published Lists
HoneySEC publishes multiple dataset thresholds and output formats. Select the combination that matches your firewall, router, or analysis workflow.
Directory
Categories
ip_all
Contains all IP addresses that have logged into any honeypot at least once.
ip_2 (recommended)
Contains IP addresses that logged into a honeypot at least 2 times. This helps eliminate false positives, typos, or one-off scanning attempts.
ip_5
Contains IP addresses that logged into a honeypot at least 5 times. Suitable for more conservative use and lower-noise analysis.
Versions
raw
Plain list of IP addresses, one per line.
cidr
List of IP addresses with a /32 prefix, one per line.
ipset
Configuration in ipset command format, adding addresses to the honeysec list.
mikrotik
Ready-to-use commands for Mikrotik RouterOS 7+, creating an address-list named honeysec.