Running a legitimate scanner or think a result is wrong? See how we classify scanners and request a review.
A coarse, public read on where internet-scanning is moving right now — which services and techniques are heating up, and the broad regions and networks they ride in on. Detailed actor and workspace evidence stays in the authenticated console, never on this page.
Services under scan
Emerging techniques
Hot regions
Hot networks (ASN)
Low false positives
An IP is listed only when many independent sensors on different networks agree — and known researchers/scanners are scrubbed. Block attackers, not your own users.
See what others miss
Behavioral intel & live malware droppers — dropper domains, URLs and file hashes, not just IPs. Indiscriminate mass-scans surfaced early, while they're still spreading.
Drops into what you run
Paste one line into the firewall or SIEM you already have — nftables, OPNsense/pfSense, RPZ, Suricata, STIX/MISP. No agent, no lock-in.
Top source countries
Top targeted ports
Top attack types
Top source networks (ASN)
Time-to-first-attack by provider
Sensor fleet by continent
Pull the signed threat-intel feed
The high-confidence mass-scanner set is published as signed artifacts you can verify before enforcement:
/blocklist.txt for IP blocking and /indicators.json for IPs, domains, URLs, and SHA-256s.
Start with the manifest for artifact URLs, signatures, counts, and copy-ready SDK commands. Operational support, allow-list review, and private integration help stay request-based while the feed matures.
View manifest → Integration playbooks → Request support →CTI / TIP
Portable STIX, TAXII, and MISP paths for enrichment platforms.
TAXII 2.1 STIX 2.1 MISP eventAppliance quickstart — OPNsense / pfSense
Use the raw text URL for firewall URL-table aliases. It is intentionally boring: comments at the top, then one bare IP address per line.
https://hexfield.io/blocklist.txt
- Choose a URL-table / remote-alias type that expects IP addresses, then point it at
/blocklist.txt. - Do not paste
/blocklist.txt.minisiginto a firewall blocklist. It is a signature sidecar for verification tools, not an IP feed. - The richer SDK/SIEM feed is
/indicators.json; its sidecar is/indicators.json.minisig.
OPNsense calls this a URL Table alias; see the official alias docs.
Cryptographically signed — don't trust, verify
Every feed file is signed offline with a key that never touches the serving infrastructure — so even a compromised edge cannot forge the list. Verify any download with stock minisign:
curl -O https://hexfield.io/hexfield.pub minisign -Vm blocklist.txt -p hexfield.pub # → "Signature and comment signature verified"
python3 -m pip install hexfield hexfield delta --verified --format nft -o /etc/nftables.d/hexfield.nft
Ed25519 · public key RWTWXqJpymdOJD… · hexfield.pub