~520 Thousand IP addresses observed from May to December 2012
To get raw lists of the data go to Download. For an explanation of what this data is and how it was obtained, see Paper.
Servicename | Product | Version | Count | Percent |
---|---|---|---|---|
rpcapd | WinPcap remote packet capture daemon | 147842 | 28.385 | |
ssl | SSLv3 | 112926 | 21.681 | |
no match | -/- | -/- | 102495 | 19.679 |
telnet | Cisco IOS telnetd | 32212 | 6.185 | |
telnet | 31000 | 5.952 | ||
telnet | Cisco router telnetd | 21543 | 4.136 | |
telnet | Cisco 1721 router telnetd | 17698 | 3.398 | |
http | 14172 | 2.721 | ||
irc | Dancer ircd | 4088 | 0.785 | |
http | SonicWALL | 4041 | 0.776 | |
chat | AIM or ICQ server | 2717 | 0.522 | |
ssh | OpenSSH | 4.3 | 2432 | 0.467 |
ssl | TLSv1 | 1986 | 0.381 | |
ssh | 1496 | 0.287 | ||
http | LogMeIn httpd | 4.0.784 | 1100 | 0.211 |
http | Microsoft IIS httpd | 858 | 0.165 | |
http | AIM | 1.0 | 696 | 0.134 |
http | Boa HTTPd | 0.94.14rc21 | 632 | 0.121 |
http | WangWnagSimpleServer | 1.0 | 505 | 0.097 |
irc-proxy | ShroudBNC irc-proxy | 1.1 revision 371 | 485 | 0.093 |
http | Cisco Secure ACS login | 484 | 0.093 | |
http | lighttpd | 1.4.29 | 457 | 0.088 |
http | lighttpd | 1.4.19 | 429 | 0.082 |
http | Lotus Expeditor Web Container | 6.1 | 410 | 0.079 |
http | Apache | 1.3.41 | 388 | 0.074 |
ssh | OpenSSH | 5.1p1 Debian 5 | 384 | 0.074 |
http | Netwave IP camera http config | 384 | 0.074 | |
ssh | OpenSSH | 5.5p1 Debian 6+squeeze2 | 374 | 0.072 |
http | RemotelyAnywhere remote PC management httpd | 8.0.668 | 372 | 0.071 |
http | LogMeIn httpd | 2.30.559 | 372 | 0.071 |
http | Microsoft IIS httpd | 6.0 | 365 | 0.07 |
http | Gateway-Webs | 353 | 0.068 | |
irc-proxy | psyBNC | 2.3.2-7 | 352 | 0.068 |
http | GoAhead-Webs httpd | 347 | 0.067 | |
http | lighttpd | 1.4.28 | 329 | 0.063 |
telnet | Linux telnetd | 320 | 0.061 | |
ssh | OpenSSH | 5.3 | 275 | 0.053 |
http | LogMeIn httpd | 4.0.680 | 266 | 0.051 |
http | Microsoft IIS httpd | 5.0 | 264 | 0.051 |
http | Microsoft HTTPAPI httpd | 2.0 | 261 | 0.05 |
http | IBM WebSphere Application Server | 6.0 | 240 | 0.046 |
http | Avtech AVN801 network camera | 1.0 | 231 | 0.044 |
http | t-gate web server | 221 | 0.042 | |
http | GoAhead-Webs embedded httpd | 210 | 0.04 | |
http | LogMeIn httpd | 4.0.734 | 208 | 0.04 |
http | Apache | 2.2.3 | 202 | 0.039 |
http | Lotus Notes Expeditor httpd | 6.1 | 188 | 0.036 |
http | RemotelyAnywhere remote PC management httpd | 10.0.1086 | 172 | 0.033 |
http | thttpd | 169 | 0.032 | |
ftp | Microsoft ftpd | 166 | 0.032 | |
http | Apache | 161 | 0.031 | |
ssh | OpenSSH | 5.3p1 Debian 3ubuntu7 | 156 | 0.03 |
vnc | VNC | 143 | 0.027 | |
http | Apache Tomcat/Coyote JSP engine | 1.1 | 141 | 0.027 |
http | thttpd | 2.25b 29dec2003 | 133 | 0.026 |
http | RemotelyAnywhere remote PC management httpd | 8.0.747 | 124 | 0.024 |
ssh | OpenSSH | 3.9p1 | 116 | 0.022 |
rtsp | 116 | 0.022 | ||
ssh | OpenSSH | 5.5p1 Debian 6+squeeze1 | 112 | 0.022 |
http | DrcomServer1.0 | 112 | 0.022 | |
ftp | 111 | 0.021 | ||
http | Indy | 9.00.10 | 108 | 0.021 |
http | LogMeIn httpd | 3.0.606 | 107 | 0.021 |
ssh | OpenSSH | 5.1 | 104 | 0.02 |
ssh | Cisco SSH | 1.25 | 103 | 0.02 |
http | Apache | 2.2.15 | 102 | 0.02 |
http | mini_httpd | 1.19 19dec2003 | 101 | 0.019 |
ssh | MikroTik RouterOS sshd | 97 | 0.019 | |
http | lighttpd | 1.4.20 | 96 | 0.018 |
smtp | Postfix smtpd | 88 | 0.017 | |
ssh | OpenSSH | 5.5p1 Debian 6 | 85 | 0.016 |
http | thttpd | 2.24 26oct2003 | 85 | 0.016 |
http | Boa HTTPd | 0.94.13 | 84 | 0.016 |
http | Indy | 9.0.11 | 82 | 0.016 |
http | Hikvision-Webs | 82 | 0.016 | |
http | PDR-M800 | 1.0 | 81 | 0.016 |
http | Microsoft IIS httpd | 7.5 | 81 | 0.016 |
telnet | WanMa Network, **** | 80 | 0.015 | |
http | Lotus Expeditor Web Container | 79 | 0.015 | |
ssh | OpenSSH | 5.9p1 Debian 5ubuntu1 | 75 | 0.014 |
http | Innovative Interfaces Innopac httpd | 110 | 71 | 0.014 |
xfce-session | XFCE Session Manager | 70 | 0.013 | |
http | Cross Web Server | 70 | 0.013 | |
ssh | OpenSSH | 5.4p1 | 69 | 0.013 |
http | Apache | 2.2.22 | 69 | 0.013 |
http | Apache | 2.2.14 | 67 | 0.013 |
http | uc-httpd | 1.0.0 | 65 | 0.012 |
xml | 64 | 0.012 | ||
http | Virata-EmWeb | 6.0.1 | 60 | 0.012 |
remoting | MS .NET Remoting services | 59 | 0.011 | |
http | Httpd | 1.0 | 59 | 0.011 |
ssh | OpenSSH | 5.9 | 58 | 0.011 |
http | Apache | 0.6.5 | 58 | 0.011 |
http | RemotelyAnywhere remote PC management httpd | 8.0.597 | 57 | 0.011 |
ssh | OpenSSH | 5.8 | 55 | 0.011 |
http | RemotelyAnywhere remote PC management httpd | 8.0.605 | 53 | 0.01 |
directconnect | Direct Connect P2P | 53 | 0.01 | |
http | lighttpd | 1.4.26 | 52 | 0.01 |
http | Apache | 2.2.16 | 52 | 0.01 |
http | httpd | 50 | 0.01 | |
http | thttpd | 2.25b | 49 | 0.009 |
http | Mobotix Camera http config | 49 | 0.009 | |
ssl | TLS | 1.0 | 48 | 0.009 |
ssh | OpenSSH | 4.7p1 Debian 8ubuntu1.2 | 47 | 0.009 |
http | thttpd | 2.24 | 47 | 0.009 |
http | Microsoft IIS httpd | 7.0 | 47 | 0.009 |
http | GoAhead-Webs | 47 | 0.009 | |
arcserve | ARCserve Discovery | 47 | 0.009 | |
ssh | OpenSSH | 4.3p2 Debian 9etch3 | 46 | 0.009 |
ssh | Dropbear sshd | 0.52 | 46 | 0.009 |
http | Gadspot/Avtech AV787 webcam http config | 46 | 0.009 | |
ssh | OpenSSH | 2.3.0 mikrotik 2.9 | 45 | 0.009 |
http | Network Camera | 45 | 0.009 | |
ssh | OpenSSH | 5.2 | 44 | 0.008 |
socks5 | 44 | 0.008 | ||
http | GeoVision GeoHttpServer for webcams | 43 | 0.008 | |
http | uTorrent WebUI | 42 | 0.008 | |
http | dcs-lig-httpd | 39 | 0.007 | |
http | Microsoft IIS httpd | 5.1 | 37 | 0.007 |
http | Mbedthis-Appweb | 2.0.4 | 37 | 0.007 |
telnet | Cisco 2514 router telnetd | 36 | 0.007 | |
http | DVR Systems webcam http interface | 36 | 0.007 | |
ssh | OpenSSH | 5.8p1 Debian 1ubuntu3 | 35 | 0.007 |
http | Draytek Vigor ADSL router webadmin | 35 | 0.007 | |
dominoconsole | Lotus Domino Console | 35 | 0.007 | |
http | Apache | 1.3.28 | 34 | 0.007 |
ftp | Pure-FTPd | 34 | 0.007 | |
http | GM Streaming Server httpd | 33 | 0.006 | |
http | D-Link DIR-300 WAP http admin | 32 | 0.006 | |
ssh | OpenSSH | 5.8p1 Debian 7ubuntu1 | 31 | 0.006 |
socks-proxy | Socks4A | 31 | 0.006 | |
ssh | OpenSSH | 5.0 | 30 | 0.006 |
http | WYM httpd | 1.0 | 30 | 0.006 |
ssh | OpenSSH | 5.5 | 29 | 0.006 |
ssh | OpenSSH | 4.5p1 | 29 | 0.006 |
http-proxy | Squid http proxy | 29 | 0.006 | |
http | Cisco Secure ACS web interface | 29 | 0.006 | |
http | Bchat | 29 | 0.006 | |
http | RemotelyAnywhere remote PC management httpd | 6.20.467 | 28 | 0.005 |
http | LogMeIn httpd | 4.0.994 | 28 | 0.005 |
ssh | OpenSSH | 5.4 | 27 | 0.005 |
ssh | OpenSSH | 4.3p2 Debian 9etch2 | 27 | 0.005 |
ssh | OpenSSH | 3.6.1p2 | 27 | 0.005 |
imond | imond fli4l router config | 27 | 0.005 | |
http | D-Link/Airlink IP webcam http config | 1.0 | 27 | 0.005 |
http | Apache | 2.2.9 | 27 | 0.005 |
nntp | INN nntpd | 26 | 0.005 | |
http | Vivotek IP7131 Network Camera http config | 26 | 0.005 | |
vnc | 25 | 0.005 | ||
shoutcast-publishing | SHOUTcast publishing port | 25 | 0.005 | |
http | RemotelyAnywhere remote PC management httpd | 7.10.552 | 25 | 0.005 |
http | CordaServer | 7.2.5.3711 (PopChart | 25 | 0.005 |
http | CordaServer | 7.0.1.1366 (PopChart | 25 | 0.005 |
ftp | Serv-U ftpd | 6.4 | 25 | 0.005 |
ssh | Kojoney SSH honeypot | 24 | 0.005 | |
http | Wireless Network Camera | 24 | 0.005 | |
http | RemotelyAnywhere remote PC management httpd | 9.0.856 | 24 | 0.005 |
ssh | OpenSSH | 5.5p1 Debian 4ubuntu6 | 23 | 0.004 |
shoutcast | SHOUTcast server | 1.9.5 | 23 | 0.004 |
http | CCcam card sharing system http config | 23 | 0.004 | |
rifa-dvr | Rifatron DVR | 22 | 0.004 | |
http-proxy | Squid http proxy | 2.7.STABLE9 | 22 | 0.004 |
http | Apache | 2.2.21 | 22 | 0.004 |
http | Apache | 2.2.17 | 22 | 0.004 |
ftp | vsftpd | 2.0.8 or later | 22 | 0.004 |
upnp | Portable SDK for UPnP devices | 1.3.1 | 21 | 0.004 |
telnet | Frontier Internet * | 21 | 0.004 | |
ssh | OpenSSH | 5.4p1_hpn13v11 | 21 | 0.004 |
ssh | OpenSSH | 5.3p1 Debian 3ubuntu6 | 21 | 0.004 |
http | TRENDnet TV-IP100 or TV-IP110 webcam display httpd | 21 | 0.004 | |
http | LogMeIn httpd | 4.0.732 | 21 | 0.004 |
http | lighttpd | 21 | 0.004 | |
http | CordaServer | 6.0.483 | 21 | 0.004 |
http | Apache | 2.0.53 | 21 | 0.004 |
vnc | RealVNC Personal | 20 | 0.004 | |
vnc-http | RealVNC | 4.0 | 20 | 0.004 |
ssh | OpenSSH | 4.6 | 20 | 0.004 |
ssh | Dropbear sshd | 0.51 | 20 | 0.004 |
smtp | 20 | 0.004 | ||
shoutcast | SHOUTcast server | 1.9.8 | 20 | 0.004 |
openvpn | OpenVPN | 20 | 0.004 | |
http | lighttpd | 1.4.30 | 20 | 0.004 |
http | Intoto httpd | 1.0 | 20 | 0.004 |
http | CordaServer | 6.0.706 | 20 | 0.004 |
http | Apache | 2 | 20 | 0.004 |
ssh | OpenSSH | 6.0 | 19 | 0.004 |
ssh | OpenSSH | 5.9p1-hpn13v11 | 19 | 0.004 |
ssh | OpenSSH | 4.3p2 Debian 9 | 19 | 0.004 |
ssh | OpenSSH | 3.8.1p1 Debian 8.sarge.6 | 19 | 0.004 |
ssh | Dropbear sshd | 0.53.1 | 19 | 0.004 |
http | LogMeIn httpd | 4.0.656 | 19 | 0.004 |
http | LogMeIn httpd | 2.30.555 | 19 | 0.004 |
http | LogMeIn httpd | 2.30.539 | 19 | 0.004 |
http | Allegro RomPager | 4.07 UPnP/1.0 | 19 | 0.004 |
urp | UNO Remote Protocol (URP) | 18 | 0.003 | |
smtp | Microsoft Exchange smtpd | 18 | 0.003 | |
http | World Client WDaemon httpd | 4.0 | 18 | 0.003 |
http | RemotelyAnywhere remote PC management httpd | 7.00.531 | 18 | 0.003 |
http | LogMeIn httpd | 4.0.771 | 18 | 0.003 |
http | LogMeIn httpd | 2.30.511 | 18 | 0.003 |
http | CordaServer (PopChartServer compatible) 5.1.2h | 18 | 0.003 | |
http | CordaServer | 6.0.597 | 18 | 0.003 |
telnet | Tachyon.NET * | 17 | 0.003 | |
ssh | OpenSSH | 5.3p1 Debian 3ubuntu5 | 17 | 0.003 |
http | MiniServ | 0.01 | 17 | 0.003 |
citrix-ica | Citrix Metaframe XP ICA | 17 | 0.003 | |
ssh | OpenSSH | 5.1p1 | 16 | 0.003 |
mongodb | MongoDB | .00. | 16 | 0.003 |
http | Apache | 2.0.52 | 16 | 0.003 |
ftp | ProFTPD | 16 | 0.003 | |
vnc | RealVNC Enterprise | 15 | 0.003 | |
http | TP-LINK Router | 15 | 0.003 | |
http | thttpd | 2.19-MX Dec 8 2009 | 15 | 0.003 |
http-proxy | Squid http proxy | 2.6.STABLE12 | 15 | 0.003 |
http | MiniServ | 1.580 | 15 | 0.003 |
http | CordaServer | 6.0.727 | 15 | 0.003 |
http | Apache | 2.2.8 | 15 | 0.003 |
http | Apache | 2.2.11 | 15 | 0.003 |
http | Airlink 101 or TRENDnet TVIP-422w webcam http config | 15 | 0.003 | |
ftp | Microsoft ftpd | 5.0 | 15 | 0.003 |
ftp | FileZilla ftpd | 0.9.41 beta | 15 | 0.003 |