~11 Thousand IP addresses observed from May to December 2012
To get raw lists of the data go to Download. For an explanation of what this data is and how it was obtained, see Paper.
Servicename  |
Product |
Count |
Percent |
|---|---|---|---|
| irc | Dancer ircd | 3750 | 32.175 |
| chat | AIM or ICQ server | 1751 | 15.024 |
| no match | -/- | 1701 | 14.595 |
| http | WangWnagSimpleServer | 767 | 6.581 |
| ibm-mqseries | IBM WebSphere MQ | 660 | 5.663 |
| http | lighttpd | 392 | 3.363 |
| http | 386 | 3.312 | |
| irc-proxy | psyBNC | 240 | 2.059 |
| http | Apache | 239 | 2.051 |
| http | Microsoft IIS httpd | 177 | 1.519 |
| http | Microsoft HTTPAPI httpd | 146 | 1.253 |
| http | thttpd | 134 | 1.15 |
| http | GoAhead-Webs httpd | 98 | 0.841 |
| directconnect | Direct Connect P2P | 96 | 0.824 |
| ssh | OpenSSH | 91 | 0.781 |
| ssh | 90 | 0.772 | |
| http | Boa HTTPd | 67 | 0.575 |
| vnc | VNC | 48 | 0.412 |
| telnet | 48 | 0.412 | |
| http-proxy | Squid http proxy | 48 | 0.412 |
| ftp | FileZilla ftpd | 44 | 0.378 |
| arcserve | ARCserve Discovery | 35 | 0.3 |
| ftp | Microsoft ftpd | 33 | 0.283 |
| ssl/openvas | OpenVAS server | 31 | 0.266 |
| nntp | INN nntpd | 25 | 0.215 |
| http | Hikvision-Webs | 25 | 0.215 |
| mysql | MySQL | 23 | 0.197 |
| http | nginx | 23 | 0.197 |
| ssl | TLS | 22 | 0.189 |
| http | BusyBox httpd | 20 | 0.172 |
| smtp | Microsoft ESMTP | 17 | 0.146 |
| ftp | vsftpd (before 2.0.8) or WU-FTPD | 17 | 0.146 |
| ftp | ProFTPD | 17 | 0.146 |
| vnc | 15 | 0.129 | |
| ftp | 14 | 0.12 | |
| upnp | Portable SDK for UPnP | 13 | 0.112 |
| ssl | TLSv1 | 13 | 0.112 |
| http | GeoVision GeoHttpServer for webcams | 13 | 0.112 |
| http-proxy | F5 BIG-IP load balancer http proxy | 12 | 0.103 |
| ssh | Dropbear sshd | 11 | 0.094 |
| http | Boa httpd | 11 | 0.094 |
| smtp | 10 | 0.086 |