{"feed_id": "ai-honeypots-ioc-feed-v1-latest", "feed_name": "AI Honeypot Observatory \u2014 IOC Feed", "description": "High-confidence indicators from the last 24 hours only. Subset of the full 7-day feed. Suitable for real-time blocking and SIEM ingestion.", "published": "2026-07-10T18:40:44.828197Z", "window_days": 1, "tlp": "WHITE", "license": "CC0 1.0 Universal \u2014 public domain dedication", "source_url": "https://ai-honeypots.com/feeds/", "contact": "feeds@ai-honeypots.com", "taxonomy": {"actor_categories": {"SCANNER-MASS": "High-volume single-purpose endpoint scanners; no prompt interaction", "SCANNER-ENUM": "Multi-persona enumerators systematically mapping AI service surfaces", "SCANNER-COORDINATED": "Multi-IP clusters operating as a single coordinated scan campaign", "MCP-SCANNER": "Dedicated Model Context Protocol endpoint probers", "RELAY-OPERATOR": "Shadow API backend pool managers; clockwork rotation, no prompts", "RELAY-VERIFIER": "Automated relay health-check systems using canned test prompts", "RELAY-CUSTOMER": "End-users of relay pools; uses relay-specific model aliases", "RELAY-CATALOGER": "Model\u00d7persona matrix sweepers building backend capability inventories", "IDENTITY-PROBER": "Prompt-engineering attacks to extract true model identity", "CREDENTIAL-HARVESTER": "Targets .env, API keys, config files; no AI interaction", "INFRA-COLLISION": "Legitimate infrastructure accidentally hitting AI endpoints"}, "confidence_levels": {"low": "< 100 observed hits in window", "medium": "100\u2013499 observed hits", "high": "500+ hits OR 5+ distinct personas targeted", "very-high": "2000+ observed hits"}, "tlp": "WHITE \u2014 unrestricted, may be shared publicly", "license": "CC0 1.0 Universal \u2014 no rights reserved"}, "summary": {"total_iocs": 25, "by_category": {"RELAY-VERIFIER": 1, "CREDENTIAL-HARVESTER": 31, "MCP-SCANNER": 82, "SCANNER-ENUM": 76, "RELAY-CUSTOMER": 19, "IDENTITY-PROBER": 4, "SCANNER-MASS": 123}, "window_days": 1}, "indicators": [{"ioc_type": "ip", "value": "118.194.252.175", "tlp": "WHITE", "confidence": "very-high", "actor_category": "RELAY-VERIFIER", "ttps": ["T1046", "T1102", "T1078"], "first_seen": "2026-07-09T18:44:16.773883+00:00", "last_seen": "2026-07-10T18:40:31.239107+00:00", "total_hits": 6534, "distinct_personas": 5, "distinct_paths": 1, "prompt_count": 6534, "user_agents": ["Go-http-client/1.1"], "models_requested": ["claude-haiku-4-5", "claude-opus-4-6", "claude-opus-4-6-20250514", "claude-opus-4-8", "claude-sonnet-4-6", "claude-sonnet-4-6-20250514", "deepseek-v4-pro", "deepseek-v4-pro:cloud", "gemini-2.5-flash", "gemini-2.5-pro"], "interesting_paths": [], "sample_prompts": ["What is the weather in Beijing right now? Use the get_weather tool to find out.", "ping"], "details": "Systematic health-check automation rotating across 5 AI service personas with canned test prompts (e.g. 'Reply: ok-test'). Consistent with a shadow API relay operator confirming backend endpoint liveness before routing paying customers. Auth token reuse across relay pool is common with this pattern.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "5.189.162.212", "tlp": "WHITE", "confidence": "very-high", "actor_category": "CREDENTIAL-HARVESTER", "ttps": ["T1046", "T1552.001"], "first_seen": "2026-07-10T12:55:41.692213+00:00", "last_seen": "2026-07-10T13:43:59.651746+00:00", "total_hits": 5304, "distinct_personas": 1, "distinct_paths": 5294, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"], "models_requested": [], "interesting_paths": ["/*.backup.swp", "/*.copy.backup.backup", "/*.copy.backup.bak", "/*.copy.backup.orig", "/*.copy.backup.swp", "/*.copy.backup~", "/*.copy.bak", "/*.copy.old", "/*.copy.orig", "/*.copy.orig.backup"], "sample_prompts": [], "details": "Targeted credential and configuration file paths exclusively (1753 hits, 5304 total). No AI model interaction \u2014 pure file-path harvesting consistent with automated vulnerability scanners seeking exposed secrets, API keys, and environment files.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "209.99.186.235", "tlp": "WHITE", "confidence": "very-high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T19:34:36.540235+00:00", "last_seen": "2026-07-10T18:01:23.370897+00:00", "total_hits": 4652, "distinct_personas": 6, "distinct_paths": 48, "prompt_count": 1719, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0"], "models_requested": [], "interesting_paths": ["/_cat/indices", "/_scripts/check", "/api/backup", "/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-10008/start", "/containers/nginx-16765/start", "/containers/nginx-19028/start"], "sample_prompts": ["[MCP tools/call] executeCommand: {\"command\": \"id\"}", "[MCP tools/call] execute_command: {\"command\": \"id\"}", "[MCP tools/call] execute_shell: {\"command\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 3755\u00d7 across 4652 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "144.202.52.34", "tlp": "WHITE", "confidence": "very-high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046", "T1102"], "first_seen": "2026-07-10T17:13:35.532065+00:00", "last_seen": "2026-07-10T17:48:01.558138+00:00", "total_hits": 2153, "distinct_personas": 1, "distinct_paths": 2, "prompt_count": 1358, "user_agents": ["Kilo-Code/7.4.5 ai-sdk/provider-utils/4.0.27 runtime/bun/1.3.14", "ZooCode/3.66.0", "curl/7.68.0", "node", "node-fetch"], "models_requested": ["claude-fable-5-20250514"], "interesting_paths": [], "sample_prompts": ["\"huh", "*Kauan looks around... A foreign place..*", "Calculate 98827+71818, and reply with the result only."], "details": "Sent 1358 prompts across 1 AI service personas. Does not match known relay or identity-probe signatures; may be a novel operator, low-volume researcher, or emerging pattern.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "153.125.146.142", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T23:04:55.589568+00:00", "last_seen": "2026-07-10T17:20:49.693606+00:00", "total_hits": 1735, "distinct_personas": 6, "distinct_paths": 23, "prompt_count": 564, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/.well-known/mcp.json", "/_cat/indices", "/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-29409/start", "/containers/nginx-32386/start", "/containers/nginx-37274/start", "/containers/nginx-47854/start"], "sample_prompts": ["[MCP tools/call] executeCommand: {\"command\": \"id\"}", "[MCP tools/call] execute_command: {\"command\": \"id\"}", "[MCP tools/call] execute_shell: {\"command\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 1345\u00d7 across 1735 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "183.91.9.63", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T18:57:56.597102+00:00", "last_seen": "2026-07-10T00:21:22.093736+00:00", "total_hits": 1281, "distinct_personas": 7, "distinct_paths": 19, "prompt_count": 480, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/_cat/indices", "/_scripts/check", "/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-22346/start", "/containers/nginx-28446/start", "/containers/nginx-40830/start", "/containers/nginx-73182/start"], "sample_prompts": ["[MCP tools/call] executeCommand: {\"command\": \"id\"}", "[MCP tools/call] execute_command: {\"command\": \"id\"}", "[MCP tools/call] execute_shell: {\"command\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 1039\u00d7 across 1281 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "45.148.10.59", "tlp": "WHITE", "confidence": "high", "actor_category": "CREDENTIAL-HARVESTER", "ttps": ["T1046", "T1552.001"], "first_seen": "2026-07-10T15:53:49.728843+00:00", "last_seen": "2026-07-10T16:13:15.011294+00:00", "total_hits": 1100, "distinct_personas": 1, "distinct_paths": 814, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Linux; Android 14; SM-S918B Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/121.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.165 Mobile Safari/537.36", "Mozilla/5.0 (Linux; U; Android 14; en-US; Redmi Note 13 Pro Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 UCBrowser/13.4.0.1306 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/%2e%2e%2f%2e%2e%2fetc%2fpasswd", "/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd", "/%2e%2e/%2e%2e/%2e%2e/etc/passwd", "/%2e%2e/%2e%2e/.aws/credentials", "/%2e%2e/%2e%2e/.env", "/%2e%2e/%2e%2e/app/.env", "/%2e%2e/%2e%2e/etc/apache2/apache2.conf", "/%2e%2e/%2e%2e/etc/hosts", "/%2e%2e/%2e%2e/etc/nginx/nginx.conf", "/%2e%2e/%2e%2e/etc/passwd"], "sample_prompts": [], "details": "Targeted credential and configuration file paths exclusively (636 hits, 1100 total). No AI model interaction \u2014 pure file-path harvesting consistent with automated vulnerability scanners seeking exposed secrets, API keys, and environment files.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "8.138.17.213", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T19:46:24.319875+00:00", "last_seen": "2026-07-10T15:57:21.907182+00:00", "total_hits": 1022, "distinct_personas": 6, "distinct_paths": 18, "prompt_count": 428, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/.well-known/mcp.json", "/_cat/indices", "/_scripts/check", "/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-16825/start", "/containers/nginx-30150/start", "/containers/nginx-50800/start"], "sample_prompts": ["[MCP tools/call] add_cron_job: {\"command\": \"id\"}", "[MCP tools/call] eval: {\"code\": \"id\"}", "[MCP tools/call] eval: {\"expression\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 743\u00d7 across 1022 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "141.11.157.12", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T21:46:52.421503+00:00", "last_seen": "2026-07-10T12:55:31.724480+00:00", "total_hits": 779, "distinct_personas": 6, "distinct_paths": 16, "prompt_count": 301, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/_cat/indices", "/_scripts/check", "/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-21048/start", "/containers/nginx-31035/start", "/containers/nginx-38634/start", "/containers/nginx-76086/start"], "sample_prompts": ["[MCP tools/call] add_cron_job: {\"command\": \"id\"}", "[MCP tools/call] eval: {\"code\": \"id\"}", "[MCP tools/call] eval: {\"expression\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 617\u00d7 across 779 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "103.168.66.237", "tlp": "WHITE", "confidence": "high", "actor_category": "CREDENTIAL-HARVESTER", "ttps": ["T1046", "T1552.001"], "first_seen": "2026-07-10T17:32:31.449089+00:00", "last_seen": "2026-07-10T17:38:24.099471+00:00", "total_hits": 713, "distinct_personas": 1, "distinct_paths": 645, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Linux; Android 14; SM-S918B Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/121.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.165 Mobile Safari/537.36", "Mozilla/5.0 (Linux; U; Android 14; en-US; Redmi Note 13 Pro Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 UCBrowser/13.4.0.1306 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/%2e%2e%2f%2e%2e%2fetc%2fpasswd", "/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd", "/%2e%2e/%2e%2e/%2e%2e/etc/passwd", "/%2e%2e/%2e%2e/.env", "/%2e%2e/%2e%2e/app/.env", "/%2e%2e/%2e%2e/etc/apache2/apache2.conf", "/%2e%2e/%2e%2e/etc/nginx/nginx.conf", "/%2e%2e/%2e%2e/etc/passwd", "/%2e%2e/%2e%2e/etc/ssh/sshd_config", "/%2e%2e/%2e%2e/home/.env"], "sample_prompts": [], "details": "Targeted credential and configuration file paths exclusively (408 hits, 713 total). No AI model interaction \u2014 pure file-path harvesting consistent with automated vulnerability scanners seeking exposed secrets, API keys, and environment files.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "46.101.114.225", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T21:11:05.445781+00:00", "last_seen": "2026-07-10T06:47:21.270986+00:00", "total_hits": 633, "distinct_personas": 4, "distinct_paths": 12, "prompt_count": 270, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-12865/start", "/containers/nginx-25087/start", "/containers/nginx-36359/start", "/images/json", "/mcp", "/sse"], "sample_prompts": ["[MCP tools/call] add_cron_job: {\"command\": \"id\"}", "[MCP tools/call] eval: {\"code\": \"id\"}", "[MCP tools/call] eval: {\"expression\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 455\u00d7 across 633 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "45.144.164.52", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T19:47:26.256085+00:00", "last_seen": "2026-07-10T07:55:12.629451+00:00", "total_hits": 569, "distinct_personas": 6, "distinct_paths": 15, "prompt_count": 211, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/_cat/indices", "/_scripts/check", "/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-17314/start", "/containers/nginx-38467/start", "/containers/nginx-61150/start", "/containers/nginx-76117/start"], "sample_prompts": ["[MCP tools/call] add_cron_job: {\"command\": \"id\"}", "[MCP tools/call] eval: {\"code\": \"id\"}", "[MCP tools/call] eval: {\"expression\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 456\u00d7 across 569 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "124.220.155.117", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-09T21:17:23.455878+00:00", "last_seen": "2026-07-10T16:32:10.025960+00:00", "total_hits": 379, "distinct_personas": 5, "distinct_paths": 17, "prompt_count": 135, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/.well-known/mcp.json", "/_cat/indices", "/_scripts/check", "/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-11057/start", "/containers/nginx-11673/start", "/containers/nginx-70279/start"], "sample_prompts": ["[MCP tools/call] executeCommand: {\"command\": \"id\"}", "[MCP tools/call] execute_command: {\"command\": \"id\"}", "[MCP tools/call] execute_shell: {\"command\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 302\u00d7 across 379 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "47.95.178.229", "tlp": "WHITE", "confidence": "high", "actor_category": "MCP-SCANNER", "ttps": ["T1046", "T1190"], "first_seen": "2026-07-10T01:31:15.078804+00:00", "last_seen": "2026-07-10T10:16:13.797555+00:00", "total_hits": 258, "distinct_personas": 5, "distinct_paths": 11, "prompt_count": 104, "user_agents": ["Go-http-client/1.1", "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/api/mcp", "/api/v1/", "/containers/create", "/containers/json", "/containers/nginx-23502/start", "/containers/nginx-58929/start", "/images/json", "/mcp", "/sse", "/version"], "sample_prompts": ["[MCP tools/call] add_cron_job: {\"command\": \"id\"}", "[MCP tools/call] eval: {\"code\": \"id\"}", "[MCP tools/call] eval: {\"expression\": \"id\"}"], "details": "Probed Model Context Protocol (MCP) endpoints 190\u00d7 across 258 total requests. MCP is an emerging AI orchestration protocol; these scans map exposed MCP surfaces for potential tool-injection or server-side request forgery attacks.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "139.162.8.186", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-10T16:27:54.973265+00:00", "last_seen": "2026-07-10T16:28:56.436298+00:00", "total_hits": 111, "distinct_personas": 11, "distinct_paths": 35, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (Android 8; Mobile; rv:129.0.1) Gecko/129.0.1 Firefox/129.0.1"], "models_requested": [], "interesting_paths": ["/+CSCOE+/logon.html", "/Account/Login", "/CFIDE/componentutils/", "/Nmap/folder/check1783700891", "/NmapUpperCheck1783700891", "/api/v2/about", "/base.jhtml", "/dana-cached/hc/HostCheckerInstaller.osx", "/dana-na/nc/nc_gina_ver.txt", "/default.html"], "sample_prompts": [], "details": "Comprehensive enumeration across 11 AI service personas and 35 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "18.218.118.203", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-09T20:13:46.798044+00:00", "last_seen": "2026-07-10T13:11:16.408188+00:00", "total_hits": 40, "distinct_personas": 7, "distinct_paths": 1, "prompt_count": 0, "user_agents": ["visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": [], "sample_prompts": [], "details": "Comprehensive enumeration across 7 AI service personas and 1 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "3.129.187.38", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-09T21:37:29.803537+00:00", "last_seen": "2026-07-10T16:37:30.658767+00:00", "total_hits": 30, "distinct_personas": 7, "distinct_paths": 2, "prompt_count": 0, "user_agents": ["visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/ui/"], "sample_prompts": [], "details": "Comprehensive enumeration across 7 AI service personas and 2 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "172.93.106.153", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-10T06:17:06.307928+00:00", "last_seen": "2026-07-10T14:51:10.057737+00:00", "total_hits": 26, "distinct_personas": 5, "distinct_paths": 11, "prompt_count": 0, "user_agents": ["Umai-Scanner/2.0 (+https://umai.entelijan.com/methodology)"], "models_requested": [], "interesting_paths": ["/api/v1/health", "/chat/completions", "/collections", "/docs", "/models", "/openapi.json", "/this-should-not-exist-umai-check", "/v1/embeddings"], "sample_prompts": [], "details": "Comprehensive enumeration across 5 AI service personas and 11 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "78.159.110.10", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-10T08:20:54.876891+00:00", "last_seen": "2026-07-10T08:52:33.317352+00:00", "total_hits": 23, "distinct_personas": 10, "distinct_paths": 2, "prompt_count": 0, "user_agents": [], "models_requested": [], "interesting_paths": ["/evm"], "sample_prompts": [], "details": "Comprehensive enumeration across 10 AI service personas and 2 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "217.136.67.175", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-09T22:38:26.493572+00:00", "last_seen": "2026-07-09T22:39:12.978951+00:00", "total_hits": 21, "distinct_personas": 9, "distinct_paths": 3, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36"], "models_requested": [], "interesting_paths": ["/favicon.ico", "/ui/"], "sample_prompts": [], "details": "Comprehensive enumeration across 9 AI service personas and 3 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "18.116.101.220", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-09T20:22:58.936229+00:00", "last_seen": "2026-07-10T18:36:00.312679+00:00", "total_hits": 21, "distinct_personas": 7, "distinct_paths": 1, "prompt_count": 0, "user_agents": ["visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": [], "sample_prompts": [], "details": "Comprehensive enumeration across 7 AI service personas and 1 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "118.193.37.50", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-10T01:01:59.636560+00:00", "last_seen": "2026-07-10T11:40:34.313745+00:00", "total_hits": 14, "distinct_personas": 6, "distinct_paths": 1, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (compatible; foda-scanner/0.1)"], "models_requested": [], "interesting_paths": [], "sample_prompts": [], "details": "Comprehensive enumeration across 6 AI service personas and 1 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "5.187.35.142", "tlp": "WHITE", "confidence": "high", "actor_category": "CREDENTIAL-HARVESTER", "ttps": ["T1046", "T1552.001"], "first_seen": "2026-07-09T19:11:17.798561+00:00", "last_seen": "2026-07-10T07:47:10.689515+00:00", "total_hits": 6, "distinct_personas": 6, "distinct_paths": 1, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"], "models_requested": [], "interesting_paths": ["/../../../../../../etc/passwd"], "sample_prompts": [], "details": "Targeted credential and configuration file paths exclusively (6 hits, 6 total). No AI model interaction \u2014 pure file-path harvesting consistent with automated vulnerability scanners seeking exposed secrets, API keys, and environment files.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "123.160.223.74", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-09T20:19:55.397604+00:00", "last_seen": "2026-07-10T11:59:11.926896+00:00", "total_hits": 6, "distinct_personas": 5, "distinct_paths": 2, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"], "models_requested": [], "interesting_paths": ["/favicon.ico"], "sample_prompts": [], "details": "Comprehensive enumeration across 5 AI service personas and 2 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}, {"ioc_type": "ip", "value": "212.73.148.39", "tlp": "WHITE", "confidence": "high", "actor_category": "SCANNER-ENUM", "ttps": ["T1046"], "first_seen": "2026-07-10T02:08:04.196293+00:00", "last_seen": "2026-07-10T17:21:48.912953+00:00", "total_hits": 5, "distinct_personas": 5, "distinct_paths": 1, "prompt_count": 0, "user_agents": ["Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)"], "models_requested": [], "interesting_paths": [], "sample_prompts": [], "details": "Comprehensive enumeration across 5 AI service personas and 1 distinct paths with zero prompt interaction. Systematic surface mapping consistent with automated reconnaissance tooling building an inventory of exposed AI endpoints.", "source": "ai-honeypots.com", "honeypot_context": "Data collected from a distributed LLM honeypot network posing as Ollama, LiteLLM, OpenAI-compatible, and LM Studio endpoints. TLP:WHITE \u2014 no PII, public-facing honeypot data only."}]}