Internet conditions
What the open internet is being probed for right now, which botnet controllers are tracked, and whether every feed behind coldbraid reported in.
SANS Infocon: green.
Most-probed ports
| Port | Records | Sources | Targets |
|---|---|---|---|
| 22 | 160,078 | 8,101 | 269 |
| 8080 | 153,545 | 6,046 | 257 |
| 8000 | 143,164 | 5,556 | 262 |
| 80 | 60,669 | 6,432 | 260 |
| 23 | 49,235 | 3,670 | 270 |
| 443 | 48,583 | 7,199 | 221 |
| 2222 | 46,791 | 2,810 | 246 |
| 9000 | 32,213 | 1,082 | 220 |
| 7680 | 27,728 | 2,656 | 16 |
| 16767 | 27,042 | 1,880 | 12 |
| 51413 | 26,729 | 2,173 | 19 |
| 5555 | 24,065 | 831 | 242 |
| 137 | 14,300 | 238 | 174 |
| 123 | 13,402 | 997 | 201 |
| 7547 | 11,589 | 728 | 192 |
| 3389 | 6,937 | 567 | 243 |
| 52528 | 6,740 | 3 | 11 |
| 60437 | 6,715 | 333 | 4 |
| 0 | 6,472 | 299 | 56 |
| 8443 | 6,383 | 693 | 245 |
Reporting stations
| Source | Status | Records |
|---|---|---|
| CISA Known Exploited Vulnerabilities | reporting | 1,779 |
| NVD (via fkie-cad mirror) | reporting | 5,321 |
| Krebs on Security | reporting | 10 |
| BleepingComputer | reporting | 15 |
| SecurityWeek | reporting | 10 |
| The Record | reporting | 5 |
| Unit 42 | reporting | 15 |
| heise security | reporting | 20 |
| Schneier on Security | reporting | 10 |
| The Hacker News | reporting | 50 |
| BSI CERT-Bund | reporting | 60 |
| Dark Reading | reporting | 50 |
| Cisco Talos | reporting | 15 |
| CISA Advisories | reporting | 30 |
| Golem Security | reporting | 40 |
| Microsoft Security Update Guide | reporting | 60 |
| SANS Internet Storm Center | reporting | 10 |
| Kaspersky Securelist | reporting | 10 |
| Google Project Zero | reporting | 10 |
| ransomware.live | reporting | 1,566 |
| MITRE ATT&CK Enterprise | reporting | 178 |
| abuse.ch Feodo Tracker | reporting | 5 |
| abuse.ch ThreatFox | silent | – |
| SANS Internet Storm Center | reporting | 1 |
| CVE Program (cvelistV5) | reporting | 364 |
| FIRST EPSS | reporting | 5,320 |
| nomi-sec/PoC-in-GitHub | reporting | 234 |