Live data · free to read
Aggregate statistics from the sensors behind the SciScope Scanner Feed — published in full, with no key and no signup. This page is regenerated from the same bundle the API serves, so what you see here is what subscribers are getting.
Data generated · refreshed hourly
Real rows from the published bundle — the same records a subscriber's firewall is pulling. Ten of 17,144, without the evidence breakdown that comes with the full feed.
| address | score | cc | network | tags | last seen |
|---|---|---|---|---|---|
| 185.242.3.195 | 100 | DE | NETIFACE-TORONTO - Netiface America, Inc.AS401626 | asn_drop corroborated | 2026-08-01 |
| 195.178.110.137 | 100 | AD | DMZHOST - TECHOFF SRV LIMITEDAS48090 | asn_drop corroborated | 2026-08-01 |
| 205.210.31.236 | 100 | US | GOOGLE-CLOUD-PLATFORM - Google LLCAS396982 | host:GCP | 2026-08-01 |
| 45.153.34.186 | 100 | NL | TECHTIES-AS - TechTies Inc.AS197170 | asn_drop corroborated | 2026-08-01 |
| 79.124.62.230 | 100 | SC | DM_AUTO - DM AUTO EOODAS207812 | asn_drop corroborated | 2026-08-01 |
| 69.5.169.187 | 99 | DE | BANDWIDTH-AS - Hydra Communications LtdAS25369 | host:Zare | 2026-08-01 |
| 94.154.43.254 | 98 | NL | STORMCLOUD-AS - Storm Industries LLCAS219502 | 2026-08-01 | |
| 192.161.49.2 | 96 | US | HOSTP-LA - HostPapaAS23273 | host:HostPapa | 2026-08-01 |
| 135.237.125.237 | 95 | US | MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft CorporationAS8075 | host:Azure | 2026-08-01 |
| 65.49.1.192 | 94 | US | HURRICANE - Hurricane Electric LLCAS6939 | host:Hurricane Electric | 2026-08-01 |
corroborated means an independent public list agrees with us. The rows without it are the point: 54% of the feed carries no outside corroboration at all (7-day average) — our sensors saw it and nobody else's list has it yet.
Firewall drops, SSH attempts and web probes, averaged across the network. Per sensor rather than in total, so the line tracks the internet and not the size of our estate.
What the internet is knocking on, as a share of all events.
The mix behind the numbers above.
Geolocation of the IPs currently on the feed — where the traffic comes from, not where our sensors are. Mostly rented machines, so this tracks hosting concentration rather than any national characteristic.
Continent level, and deliberately no finer. A sensor in an unrepresented region sees campaigns the others never will, so the gaps below are real gaps.
Everything above comes from one endpoint. Here is exactly what a call looks like and exactly what comes back — no signup needed to read this.
# any key, including a Free one curl -s -H "Authorization: Bearer $SCISCOPE_KEY" \ https://api.sciscope.ee/v1/stats # -> { "generated_utc": "2026-08-01T19:23:10Z", "totals": { "scored_ips": 94047, "on_feed": 17144, "on_blocklist": 8461, "identified_crawlers": 126 }, "events_per_day_30d": [ /* 30 days */ ], "top_dst_ports_7d": [ /* 15 rows */ ], "event_types_7d": [ /* by volume */ ], "top_feed_countries": [ /* 15 rows */ ] }
# 198.51.100.24 is a documentation address (RFC 5737), used here as an example curl -s -H "Authorization: Bearer $SCISCOPE_KEY" \ https://api.sciscope.ee/v1/ip/198.51.100.24 # -> { "ip": "198.51.100.24", "found": true, "score": 87.4, "raw_score": 91.0, "sensor_count": 3, "signal_events_30d": 1284, "first_seen": "2026-07-09", "last_seen": "2026-07-28", "last_signal": "2026-07-28", "geo": { "country": "US", "asn": 64496, "as_org": "Example Hosting" }, "tags": [ "scanner", "ssh", "multi-sensor" ], "evidence": { /* per-signal breakdown: what fired, when, how often */ }, "updated_utc": "2026-08-01T19:23:10Z" }
Every flagged address ships with the evidence behind it. If you disagree with a verdict you can see precisely what produced it — which is the whole difference between a feed you can operate and a list you have to trust.
Get a key
A 14-day trial gives you the full Pro feature set — feed, history, per-IP lookups — with no card and no form. When it ends your key drops to Free rather than dying, so the statistics endpoint above keeps working indefinitely.