~520 Thousand IP addresses observed from May to December 2012
To get raw lists of the data go to Download. For an explanation of what this data is and how it was obtained, see Paper.
Servicename | Product | Count | Percent |
---|---|---|---|
rpcapd | WinPcap remote packet capture daemon | 147842 | 28.385 |
ssl | SSLv3 | 112926 | 21.681 |
no match | -/- | 102495 | 19.679 |
telnet | Cisco IOS telnetd | 32212 | 6.185 |
telnet | 31000 | 5.952 | |
telnet | Cisco router telnetd | 21543 | 4.136 |
telnet | Cisco 1721 router telnetd | 17698 | 3.398 |
http | 14172 | 2.721 | |
ssh | OpenSSH | 5163 | 0.991 |
irc | Dancer ircd | 4088 | 0.785 |
http | SonicWALL | 4041 | 0.776 |
chat | AIM or ICQ server | 2717 | 0.522 |
http | LogMeIn httpd | 2305 | 0.443 |
ssl | TLSv1 | 1986 | 0.381 |
http | Microsoft IIS httpd | 1652 | 0.317 |
ssh | 1496 | 0.287 | |
http | lighttpd | 1423 | 0.273 |
http | Apache | 1413 | 0.271 |
http | RemotelyAnywhere remote PC management httpd | 942 | 0.181 |
http | Boa HTTPd | 776 | 0.149 |
http | AIM | 696 | 0.134 |
http | thttpd | 615 | 0.118 |
http | WangWnagSimpleServer | 505 | 0.097 |
http | Lotus Expeditor Web Container | 489 | 0.094 |
irc-proxy | ShroudBNC irc-proxy | 485 | 0.093 |
http | Cisco Secure ACS login | 484 | 0.093 |
http | Netwave IP camera http config | 384 | 0.074 |
irc-proxy | psyBNC | 358 | 0.069 |
http | Gateway-Webs | 353 | 0.068 |
http | GoAhead-Webs httpd | 347 | 0.067 |
telnet | Linux telnetd | 320 | 0.061 |
http | Microsoft HTTPAPI httpd | 265 | 0.051 |
http | IBM WebSphere Application Server | 242 | 0.046 |
http | CordaServer | 233 | 0.045 |
http | Avtech AVN801 network camera | 231 | 0.044 |
http | t-gate web server | 221 | 0.042 |
http | GoAhead-Webs embedded httpd | 210 | 0.04 |
http | Indy | 201 | 0.039 |
http | Lotus Notes Expeditor httpd | 188 | 0.036 |
ftp | Microsoft ftpd | 181 | 0.035 |
vnc | VNC | 143 | 0.027 |
http | Apache Tomcat/Coyote JSP engine | 142 | 0.027 |
ssh | Dropbear sshd | 116 | 0.022 |
rtsp | 116 | 0.022 | |
http | DrcomServer1.0 | 112 | 0.022 |
ftp | 111 | 0.021 | |
http | mini_httpd | 108 | 0.021 |
ssh | Cisco SSH | 103 | 0.02 |
ssh | MikroTik RouterOS sshd | 97 | 0.019 |
smtp | Postfix smtpd | 88 | 0.017 |
http-proxy | Squid http proxy | 86 | 0.017 |
http | Hikvision-Webs | 82 | 0.016 |
http | PDR-M800 | 81 | 0.016 |
telnet | WanMa Network, **** | 80 | 0.015 |
http | Innovative Interfaces Innopac httpd | 71 | 0.014 |
xfce-session | XFCE Session Manager | 70 | 0.013 |
http | Cross Web Server | 70 | 0.013 |
http | uc-httpd | 65 | 0.012 |
xml | 64 | 0.012 | |
http | Virata-EmWeb | 62 | 0.012 |
remoting | MS .NET Remoting services | 59 | 0.011 |
http | Httpd | 59 | 0.011 |
ftp | ProFTPD | 58 | 0.011 |
http | nginx | 53 | 0.01 |
directconnect | Direct Connect P2P | 53 | 0.01 |
http | httpd | 51 | 0.01 |
ftp | Serv-U ftpd | 51 | 0.01 |
http | Mobotix Camera http config | 49 | 0.009 |
ssl | TLS | 48 | 0.009 |
http | GoAhead-Webs | 48 | 0.009 |
arcserve | ARCserve Discovery | 47 | 0.009 |
shoutcast | SHOUTcast server | 46 | 0.009 |
http | Gadspot/Avtech AV787 webcam http config | 46 | 0.009 |
http | Network Camera | 45 | 0.009 |
http | Mbedthis-Appweb | 45 | 0.009 |
ftp | FileZilla ftpd | 45 | 0.009 |
socks5 | 44 | 0.008 | |
http | GeoVision GeoHttpServer for webcams | 43 | 0.008 |
http | uTorrent WebUI | 42 | 0.008 |
http | MiniServ | 42 | 0.008 |
ftp | vsftpd | 42 | 0.008 |
http | dcs-lig-httpd | 39 | 0.007 |
http | World Client WDaemon httpd | 37 | 0.007 |
telnet | Cisco 2514 router telnetd | 36 | 0.007 |
http | DVR Systems webcam http interface | 36 | 0.007 |
mysql | MySQL | 35 | 0.007 |
http | Draytek Vigor ADSL router webadmin | 35 | 0.007 |
http | Allegro RomPager | 35 | 0.007 |
ftp | Pure-FTPd | 35 | 0.007 |
dominoconsole | Lotus Domino Console | 35 | 0.007 |
http | GM Streaming Server httpd | 33 | 0.006 |
http | D-Link DIR-300 WAP http admin | 32 | 0.006 |
socks-proxy | Socks4A | 31 | 0.006 |
http | WYM httpd | 30 | 0.006 |
http | Cisco Secure ACS web interface | 29 | 0.006 |
http | Bchat | 29 | 0.006 |
imond | imond fli4l router config | 27 | 0.005 |
http | D-Link/Airlink IP webcam http config | 27 | 0.005 |
nntp | INN nntpd | 26 | 0.005 |
http | Vivotek IP7131 Network Camera http config | 26 | 0.005 |
vnc | 25 | 0.005 | |
shoutcast-publishing | SHOUTcast publishing port | 25 | 0.005 |
mongodb | MongoDB | 25 | 0.005 |
ssh | Kojoney SSH honeypot | 24 | 0.005 |
http | Wireless Network Camera | 24 | 0.005 |
vnc-http | RealVNC | 23 | 0.004 |
upnp | Portable SDK for UPnP devices | 23 | 0.004 |
http | CCcam card sharing system http config | 23 | 0.004 |
rifa-dvr | Rifatron DVR | 22 | 0.004 |
telnet | Frontier Internet * | 21 | 0.004 |
http | TRENDnet TV-IP100 or TV-IP110 webcam display httpd | 21 | 0.004 |
vnc | RealVNC Personal | 20 | 0.004 |
smtp | 20 | 0.004 | |
openvpn | OpenVPN | 20 | 0.004 |
http | Intoto httpd | 20 | 0.004 |
smtp | Microsoft ESMTP | 19 | 0.004 |
http | Jetty | 19 | 0.004 |
urp | UNO Remote Protocol (URP) | 18 | 0.003 |
smtp | Microsoft Exchange smtpd | 18 | 0.003 |
http | CordaServer (PopChartServer compatible) 5.1.2h | 18 | 0.003 |
telnet | Tachyon.NET * | 17 | 0.003 |
citrix-ica | Citrix Metaframe XP ICA | 17 | 0.003 |
http | TwistedWeb httpd | 16 | 0.003 |
http | CherryPy httpd | 16 | 0.003 |
http | AXIS 205 network camera web interface | 16 | 0.003 |
vnc | RealVNC Enterprise | 15 | 0.003 |
ssh | SunSSH | 15 | 0.003 |
http | ZNC IRC bouncer http config | 15 | 0.003 |
http | TP-LINK Router | 15 | 0.003 |
http | Airlink 101 or TRENDnet TVIP-422w webcam http config | 15 | 0.003 |
http | Vivotek 3102 Camera http config | 14 | 0.003 |
http | TRENDnet TV-IP110w or TV-IP422W webcam display httpd | 14 | 0.003 |
http-proxy | F5 BIG-IP load balancer http proxy | 14 | 0.003 |
audioworks | AudioWorks sound server | 14 | 0.003 |
printer | Panasonic mfpscdl.exe service | 13 | 0.002 |
netbios-ssn | 13 | 0.002 | |
http | QNAP TS-219P NAS http config | 13 | 0.002 |
http | MikroTik router http config | 13 | 0.002 |
flexlm | FlexLM license manager | 13 | 0.002 |
telnet | BSD-derived telnetd | 12 | 0.002 |
telnet | Allied Telesis x900-series switch telnetd | 12 | 0.002 |
http | AIM HTTP | 12 | 0.002 |
giop | CORBA naming service | 12 | 0.002 |
telnet | the BCC terminal server | 11 | 0.002 |
http | WindWeb | 11 | 0.002 |
http | Webs | 11 | 0.002 |
http | Vivotek Network Camera | 11 | 0.002 |
http | TeamViewer httpd | 11 | 0.002 |
http | MS-SDK-HttpServer | 11 | 0.002 |
http | Cisco IOS http config | 11 | 0.002 |
http | avtech httpd | 11 | 0.002 |
vnc | Apple remote desktop vnc | 10 | 0.002 |
telnet | SMC SMC2870W Wireless Ethernet Bridge | 10 | 0.002 |
soap | gSOAP soap | 10 | 0.002 |
http | udpxy multicast UDP-to-HTTP | 10 | 0.002 |
http | Ubicom httpd | 10 | 0.002 |
http-proxy | MikroTik http proxy | 10 | 0.002 |
http | Oracle-iPlanet-Web-Server | 10 | 0.002 |
http | MikroTik router config httpd | 10 | 0.002 |
http | DD-WRT milli_httpd | 10 | 0.002 |
http | Amatic | 10 | 0.002 |