Live data · free to read

What the sensor network is seeing right now.

Aggregate statistics from the sensors behind the SciScope Scanner Feed, published in full, with no key and no signup. This page is regenerated from the same bundle the API serves, so what you see here is what subscribers are getting.

Data generated · refreshed hourly

177,222
IP addresses scored in the current window
19,345
on the feed right now
7,346
of the feed flagged by our sensors alone, with no outside corroboration, 39% (7-day average)
11,055
on the high-confidence blocklist
124
legitimate crawler IPs kept off it
01 / right now

Ten addresses on the feed as of this build

Ten entries from the live feed: the same records a subscriber's firewall is pulling right now. The full feed carries 19,345 of them, each with the evidence behind the verdict.

addressscoreccnetworktagslast seen
204.76.203.4100DEPFCLOUD - Pfcloud UG (haftungsbeschrankt)AS51396asn_drop corroborated host:Pfcloud2026-10-30
205.210.31.252100USGOOGLE-CLOUD-PLATFORM - Google LLCAS396982host:GCP2026-10-31
45.198.224.125100SEVPSVAULTHOST - VPSVAULT.HOST LTDAS215925asn_drop corroborated2026-10-31
69.164.217.74100USAKAMAI-LINODE-AP - Akamai Connected CloudAS63949host:Linode2026-10-31
77.90.185.20100DELimitedNetwork-AS - Limited Network LTDAS213790asn_drop corroborated2026-10-30
85.11.167.7100NLTECHTIES-AS - TechTies Inc.AS197170asn_drop corroborated2026-10-31
45.120.126.6697INSKYMAX-AS - Skymax Broadband Services Pvt. Ltd.AS1329342026-10-30
20.150.210.16897USMICROSOFT-CORP-MSN-AS-BLOCK - Microsoft CorporationAS8075host:Azure2026-10-31
178.128.84.18796SGDIGITALOCEAN-ASN - DigitalOcean, LLCAS14061host:DigitalOcean2026-10-31
199.165.159.1795USSHADOWSERVER-FOUNDATION - The Shadowserver Foundation, Inc.AS22168scanner_org2026-10-31
2026-10-02 · 43%range 37–46%2026-10-31 · 38%

corroborated means an independent public list agrees with us. The rows without it are the point: 39% of the feed carries no outside corroboration at all (7-day average), and our sensors saw it and nobody else's list has it yet.

02 / activity

Events per sensor, per day

What the sensors recorded each day: firewall drops, SSH attempts and web probes.

2026-10-01: 61,232 per sensor2026-10-02: 65,564 per sensor2026-10-03: 61,782 per sensor2026-10-04: 81,733 per sensor2026-10-05: 61,317 per sensor2026-10-06: 62,319 per sensor2026-10-07: 62,715 per sensor2026-10-08: 56,510 per sensor2026-10-09: 58,136 per sensor2026-10-10: 57,679 per sensor2026-10-11: 79,747 per sensor2026-10-12: 59,801 per sensor2026-10-13: 59,758 per sensor2026-10-14: 70,085 per sensor2026-10-15: 57,549 per sensor2026-10-16: 63,429 per sensor2026-10-17: 57,758 per sensor2026-10-18: 79,688 per sensor2026-10-19: 60,162 per sensor2026-10-20: 60,184 per sensor2026-10-21: 64,875 per sensor2026-10-22: 60,566 per sensor2026-10-23: 63,174 per sensor2026-10-24: 60,492 per sensor2026-10-25: 63,884 per sensor2026-10-26: 57,677 per sensor2026-10-27: 58,351 per sensor2026-10-28: 62,314 per sensor2026-10-29: 58,230 per sensor2026-10-30: 61,760 per sensor
81,73340,8660
events per sensor, per day
2026-10-01peak 81,733 per sensor on 2026-10-042026-10-30 · complete days only
03 / targets

Most-targeted destination ports, last 7 days

Which ports the internet is knocking on, as a share of all events.

port 22 SSH
4.68%
port 23 Telnet
2.23%
port 24024
0.88%
port 222
0.48%
port 8080 HTTP alt
0.31%
port 3389 RDP
0.27%
port 8443 HTTPS alt
0.24%
port 5522
0.23%
port 53 DNS
0.2%
port 443 HTTPS
0.18%
04 / behaviour

What that traffic was, last 7 days

What kind of contact those events were.

fw_block firewall drops on closed ports
92.29%
ssh_preauth SSH sessions abandoned before authentication
3.9%
web_request HTTP requests to unadvertised endpoints
2.13%
ssh_invalid_user SSH logins for users that do not exist
1.13%
web_probe HTTP probes for known-vulnerable paths
0.53%
ssh_fail failed SSH password attempts
0.01%
05 / origins

Where the flagged addresses are registered

Where the flagged addresses are registered: the traffic's origin, not our sensors'. Mostly rented infrastructure, so this reflects where hosting is cheap rather than anything about the countries themselves.

US United States
7,919
GB United Kingdom
2,327
DE Germany
1,266
CN China
1,256
NL Netherlands
845
SG Singapore
622
JP Japan
564
HK Hong Kong
530
MY Malaysia
440
BE Belgium
421
06 / coverage

Where the sensors are

Where we observe from. Regions without a sensor are marked, and the gap is real: an operation that only scans one part of the world may not reach us yet.

✓Europe
✓North America
✓Africa
·South America not yet
·Asia not yet
·Oceania not yet
07 / the api

The same data, as an API

Everything above comes from the API. Here is a real call and exactly what comes back.

Free Aggregate statistics

# any key, including a Free one
curl -s -H "Authorization: Bearer $SCISCOPE_KEY" \
     https://api.sciscope.ee/v1/stats

# ->
{
  "generated_utc": "2026-10-31T03:29:53Z",
  "totals": {
    "scored_ips": 177222,
    "on_feed": 19345,
    "on_blocklist": 11055,
    "identified_crawlers": 124
  },
  "events_per_day_30d": [ /* 30 days */ ],
  "top_dst_ports_7d":  [ /* 15 rows */ ],
  "event_types_7d":    [ /* by volume */ ],
  "top_feed_countries": [ /* 15 rows */ ]
}

One address, with its evidence

# 198.51.100.24 is a documentation address (RFC 5737), used here as an example
curl -s -H "Authorization: Bearer $SCISCOPE_KEY" \
     https://api.sciscope.ee/v1/ip/198.51.100.24

# ->
{
  "ip": "198.51.100.24",
  "found": true,
  "score": 87.4,
  "raw_score": 91.0,
  "sensor_continents": [ "Africa", "Europe" ],
  "signal_events_30d": 1284,
  "first_seen": "2026-07-09",
  "last_seen": "2026-07-28",
  "last_signal": "2026-07-28",
  "geo": { "country": "US", "asn": 64496, "as_org": "Example Hosting" },
  "tags": [ "scanner", "ssh", "multi-sensor" ],
  "evidence": { /* per-continent: first and last seen, by day */ },
  "updated_utc": "2026-10-31T03:29:53Z"
}

Every flagged address ships with the evidence behind it. If you disagree with a verdict you can see precisely what produced it, which is the whole difference between a feed you can operate and a list you have to trust.

Get a key

Read the numbers. Then try it on your own traffic.

A 14-day trial gives you the full Pro feature set (feed, history, per-IP lookups) with no card and no form. When it ends your key drops to Free rather than dying, so the statistics endpoint above keeps working indefinitely.

Request a 14-day trial See the tiers