Mirage Feed

Daily threat intelligence from the OffSeq Mirage honeypot fleet.
Handshake-verified attacker IPs, exploited CVEs, payload URLs and fingerprints,
in the formats your firewall, SIEM and threat-intel platform already read.

---

Today's snapshot

	Observed by Mirage, last 24 h	In the feed	Feed window
Source IPs active in the last 24 h	17,383	1,420	24 h
Source IPs	—	3,837	7 days
VPN / Tor exits (only in anonymizers-7d.txt)	—	302	7 days
IPv4 addresses (ipv4-30d.txt)	—	7,924	30 days
Networks (ASNs)	2,662	730	7 days
Countries	159	99	7 days
CVEs exploited (11 in CISA KEV)	15	12	7 days
Payload / download URLs	21	7	7 days
Malware hashes	2	2	30 days
Tooling fingerprints (JA4, HASSH)	—	200	7 days
Research scanners (excluded)	—	10,236	7 days
Credential pairs tried	142,101	top 100 passwords	7 days
Events	954.33k events	—	—

_{Snapshot 2026-11-05 02:46 UTC · the observed column counts everything the fleet saw in the 24 h before the snapshot (CVEs: 7 days); the feed column counts what passed the listing rules over the window shown · entries are published 24 h after first sighting · methodology}

Quick start

Point your tool at a stable URL. Files are rebuilt every day; the paths never change.

Use	URL
IPv4 blocklist, last 7 days	https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt
IPv4 top 1,000 (for small firewall tables)	https://feeds.offseq.com/mirage-feed/latest/ipv4-top1k.txt
Payload and C2 URLs	https://feeds.offseq.com/mirage-feed/latest/urls-7d.txt
Malware SHA-256	https://feeds.offseq.com/mirage-feed/latest/hashes-sha256-30d.txt
Full records (CSV)	https://feeds.offseq.com/mirage-feed/latest/attackers-7d.csv
STIX 2.1 bundle	https://feeds.offseq.com/mirage-feed/latest/stix/mirage.json
MISP feed (add as a MISP Feed)	https://feeds.offseq.com/mirage-feed/misp/

Plain lists hold one value per line with no comments, so they load as-is into pfBlockerNG, OPNsense aliases, FortiGate threat feeds and Palo Alto EDLs. A list with nothing over the listing threshold in its window is published as an empty (0-byte) file rather than dropped, so its URL never 404s and every consumer reads it as "no entries".

Which list do I want?

You want to	Use
Block attackers on a firewall	ipv4-7d.txt, plus ipv6-7d.txt if you route IPv6
Block on a device with a small table	ipv4-top1k.txt or ipv4-top10k.txt: the 1,000 or 10,000 highest-confidence addresses (file sorted by address), without shared addresses and recon alone
Block only what is active right now	ipv4-1d.txt
Alert or enrich with a longer memory	ipv4-30d.txt (better for detection than for blocking)
Review what changed since yesterday	ipv4-added-1d.txt and ipv4-removed-1d.txt
Flag VPN and Tor exits seen attacking	anonymizers-7d.txt. Shared by many users, so enrich with it, don't block it
Enrich SIEM events with context	attackers-7d.csv or records-7d.ndjson.gz
Import into a threat-intel platform	stix/mirage.json or the MISP feed
Hunt in web server logs	user-agents-7d.txt and paths-7d.txt

Schedule and polling

The feed is built once a day, usually between 03:00 and 04:00 UTC, and entries appear 24 hours after their first sighting. Poll at most once an hour; once a day after 04:00 UTC is enough. feeds.offseq.com answers If-None-Match (ETag) and If-Modified-Since with 304 Not Modified, so unchanged files cost nothing to re-check. To tell builds apart, key on build in feed.json, not generated: a rebuild of the same snapshot with changed files keeps generated and gets a new build. history.json holds 90 days of daily totals, and format changes are listed in CHANGELOG.md.

Integrations

pfSense / OPNsense

Firewall → Aliases → Add. Type URL Table (IPs), URL https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt, refresh 1 day. Use the alias as the source in a block rule on WAN.

FortiGate

config system external-resource
    edit "mirage-feed"
        set type address
        set resource "https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt"
        set refresh-rate 1440
    next
end

Palo Alto (EDL)

Objects → External Dynamic Lists → Add. Type IP List, source https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt, repeat Daily. Firewalls with a 50k EDL budget should use ipv4-top1k.txt or ipv4-top10k.txt.

MikroTik RouterOS

/tool fetch url="https://feeds.offseq.com/mirage-feed/latest/mikrotik/mirage-7d.rsc" dst-path=mirage.rsc
/import file-name=mirage.rsc

Entries carry timeout=7d, so they expire on their own.

nftables / ipset

curl -fsSL --create-dirs -o /etc/nftables.d/mirage.nft https://feeds.offseq.com/mirage-feed/latest/nft/mirage.nft
nft -f /etc/nftables.d/mirage.nft

The file defines table inet mirage_feed with drop rules on the input hook and, for routers, the forward hook. It flushes its own sets and chains first, so re-running it is safe.

curl -fsSL https://feeds.offseq.com/mirage-feed/latest/ipset/mirage.ipset | ipset restore
iptables -C INPUT -m set --match-set mirage4 src -j DROP 2>/dev/null \
  || iptables -I INPUT -m set --match-set mirage4 src -j DROP
ip6tables -C INPUT -m set --match-set mirage6 src -j DROP 2>/dev/null \
  || ip6tables -I INPUT -m set --match-set mirage6 src -j DROP

CrowdSec

curl -fsSL https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt -o mirage.txt
cscli decisions import -i mirage.txt --format values --duration 48h --scope ip --reason mirage-feed

Suricata and Zeek

Suricata IP reputation: latest/suricata/categories.txt and latest/suricata/mirage-iprep.list. Every listed address has a score from 1 to 127 (confidence × 1.27), so >,0 matches any of them:

alert ip any any -> $HOME_NET any (msg:"Mirage feed: known attacker"; iprep:src,MirageAttacker,>,0; threshold:type limit,track by_src,count 1,seconds 3600; classtype:misc-attack; sid:1900001; rev:2;)

To alert only on high-confidence addresses (confidence 64 and up, never VPN-login brute force alone), raise the threshold:

alert ip any any -> $HOME_NET any (msg:"Mirage feed: high-confidence attacker"; iprep:src,MirageAttacker,>,80; threshold:type limit,track by_src,count 1,seconds 3600; classtype:misc-attack; sid:1900005; rev:1;)

latest/suricata/mirage.rules holds the first rule plus alert-only, rate-limited hunting rules for attacker user agents and request paths and, while datasets/sha256.lst is not empty, a payload SHA-256 rule. Copy the whole suricata/ directory so the datasets/ paths resolve.

Zeek Intel framework:

redef Intel::read_files += { "/opt/mirage/mirage.intel" };

MISP, OpenCTI, Sentinel, Splunk

• MISP: Sync Actions → Feeds → Add. Source format MISP Feed, URL https://feeds.offseq.com/mirage-feed/misp/. The feed keeps the last 8 daily events; every build re-applies the current allowlist and filters to the earlier ones and sends what no longer passes as deleted attributes.
• OpenCTI: Data → Ingestion → CSV feeds, URL https://feeds.offseq.com/mirage-feed/latest/attackers-ipv4-7d.csv, with the mapper in docs/opencti-csv-mapper.json. The file leaves out addresses without a known ASN, which the mapper cannot link; they are in attackers-7d.csv and the STIX bundle. Or import latest/stix/mirage.json as a file.
• Microsoft Sentinel: the Upload Indicators API takes at most 100 objects per request, wrapped as {"sourcesystem": "OffSeq Mirage", "stixobjects": [...]}. scripts/sentinel-upload.sh splits latest/stix/mirage.json that way.
• Defender for Endpoint: import latest/defender/defender-top500.csv (one CSV import batch): the 500 highest-confidence IPv4 addresses, leaving out VPN/Tor exits, records whose only tag is web-scan, shared addresses and recon alone. MitreTechniques holds the record's lead technique: data destruction or encryption, financial theft, exploitation, then brute force, before the scanning or valid-account use around them. Rows with Severity Low import with GenerateAlert set to False.
• Splunk: upload latest/attackers-7d.csv as the lookup table file mirage_attackers.csv. Its key column is ip: ... | lookup mirage_attackers.csv ip AS src_ip OUTPUT confidence tags as_org.

What's in the feed

File	Contents
ipv4-{1d,7d,30d}.txt	Attacker IPv4 addresses by activity window
ipv4-top{1k,10k}.txt	The 1,000 or 10,000 highest-confidence addresses (file sorted by address), sized for capped firewall tables. Equal confidence is ranked by sensors, networks, hits and last sighting. Shared addresses and recon alone are left out
ipv4-7d-cidr32.txt · ipv6-7d.txt	IPv4 with /32 suffix (AWS WAF IP sets) and IPv6 /64 networks. Few attackers reach the fleet over IPv6, so ipv6-7d.txt is often empty
ipv4-added-1d.txt · ipv4-removed-1d.txt	Addresses that entered ipv4-7d.txt since the previous day's build, and every address that left it: aged out, removed on request, newly allowlisted or now a VPN/Tor exit. Unblock what is in the removed list
anonymizers-7d.txt	VPN and Tor exits that attacked the fleet (IPv4 and IPv6 /64). Kept out of every block list and rule file
known-scanners-ipv4.txt · known-scanners-ipv6.txt	Research scanners we saw and excluded (Shodan, Censys, Shadowserver …). Allowlist these if you like. Addresses in the allowlist, such as verified crawlers, are in neither list
urls-7d.txt · domains-7d.txt	Payload, dropper and C2 locations from captured exploit attempts. A domain is listed once at least 2 distinct source IPs fetched from it; most payload hosts are bare IP addresses (they stay in urls-7d.txt), so domains-7d.txt is often empty
hashes-sha256-30d.txt	Files those payloads delivered
cves-7d.csv	CVEs exploited against the fleet in the last 7 days, with CISA KEV flag and attempt counts. Lists every CVE tried by at least 2 distinct source IPs, plus every CVE on a 7-day IP record; the KEV flag comes from the CISA catalog, vendored in generator/kev.txt
fingerprints.csv · hassh.csv	JA4 TLS client fingerprints and SSH HASSH of attacker tooling
user-agents-7d.txt · paths-7d.txt	Non-browser HTTP user agents and distinctive request paths seen in attacks. For hunting, not blocking
passwords-top100.txt	The 100 passwords attackers tried most, without usernames. Values under 2 characters and bare SSL-VPN port numbers (form-field artifacts) are left out
attackers-7d.csv · attackers-ipv4-7d.csv · records-7d.ndjson.gz	One record per indicator: ASN, country, first/last seen, services, tags, ATT&CK, confidence
stix/ · misp/ · zeek/ · suricata/ · mikrotik/ · nft/ · crowdsec/ · defender/	The same data, pre-rendered
history.json	Daily totals for the last 90 days, no addresses
og.png · og-github.png	Social preview images of the day's numbers
lookup/v4/<first octet>.json · lookup/v6/<first hextet>.json	Every listed address grouped for the address lookup, with its lists and record. Listed in SHA256SUMS, and as one latest/lookup/ entry in feed.json
feed.json · SHA256SUMS · SHA256SUMS.minisig	Index with schema_version, the build id, checksums of every file (including feed.json) and signature

Every record follows schema/record.schema.json, also served at https://feeds.offseq.com/mirage-feed/schema/record.schema.json.

How an IP gets listed

An address appears in the feed only when all of these hold:

1. It completed a TCP handshake and sent application data. UDP-only and spoofable traffic never qualifies.
2. At least 3 Mirage sensors in at least 2 networks saw it within 7 days. One-off hits stay out.
3. It is not in the allowlist: private and special-purpose ranges (RFC 1918, RFC 3849, RFC 5735, RFC 6598, RFC 6890, multicast, IPv6 link-local), public DNS resolvers and root servers, and the first-party ranges of Cloudflare, Akamai (without Linode), Fastly, Apple and Microsoft 365 from the vendored MISP warninglists, Google's own ranges (not Google Cloud), GitHub and Microsoft's AS8068 edge, and the crawler ranges of Google, Bing, OpenAI, Apple, DuckDuckGo, Ahrefs and Semrush. Customer clouds (AWS, Azure, Google Cloud, Linode) are not excluded: that is where attackers rent machines.
4. It is not a known research scanner: Alpha Strike, BinaryEdge, Bitsight, Censys, Criminal IP, Cyber Resilience, Driftnet, FOFA, Hadrian, Internet Census, Internet Measurement, Intrinsec, IPIP, LeakIX, Modat, Netlas, NETSCOUT, ONYPHE, Palo Alto Xpanse, Quake, Rapid7, ReCyber, Shadowserver, Shodan, Stretchoid, Tenable, ZoomEye, university research networks and scanners that name themselves in their user agent (and otherwise send only bare HTTP clients such as curl). These go to known-scanners-*.txt. A source that tries a password or sends a CVE payload is listed whatever it calls itself, and a scanner range alone does not outweigh it.
5. Its first sighting is at least 24 hours old.

VPN and Tor exits (records tagged vpn-exit or tor-exit) are listed only in anonymizers-7d.txt and in the full-record formats, where the tag shows: CSV and NDJSON, MISP as ip-src with to_ids: false, and STIX as anonymization indicators rather than malicious-activity. They never reach a block list or rule file.

Shared addresses are malicious, but shared with real users: records whose only activity is VPN-login brute force (tags vpn-bruteforce plus at most web-exploit or web-scan, techniques T1110, T1190 and T1595 only, no CVE), mostly residential and mobile addresses of a proxy botnet, and records tagged cgnat (carrier-grade NAT, such as Starlink). Recon alone means only reconnaissance and discovery techniques (T1046, T1589, T1590, T1592, T1595) and no CVE. Both stay in ipv4-{1d,7d,30d}.txt and the formats built from those lists, but not in ipv4-top{1k,10k}.txt or the Defender CSV, and their Suricata IP reputation score is capped at 80. Shared addresses are MISP ip-src attributes with to_ids: false, and STIX malicious-activity indicators with confidence at most 50 ("Medium" on the STIX 2.1 scale).

Entries expire 7 days after the last observed activity. New activity renews them.

Before every publish, CI refuses the build when any of these checks fail:

• An attacker entry is not a single IPv4 address or IPv6 /64, is duplicated, or overlaps the allowlist (special-purpose ranges, public resolvers, root servers and the first-party ranges of Cloudflare, Google, Microsoft 365, Apple, GitHub, Akamai and Fastly) or a canary address.
• A scanner entry is wider than one address (one /64 or smaller for IPv6), or is also listed as an attacker.
• An IP, URL or domain list changes size by more than 30 % (50 % for ipv4-1d.txt) from the previous build; the limit scales with the days since that build, up to 3×. Changes under 20 entries are ignored.
• More than 40 % of a 7- or 30-day IP list is new while more than 40 % of the previous build's list is gone (plus a seventh for each further day since that build, up to 90 %).
• One ASN holds more than 25 % of the 7-day list and more than 10 points over its share in the previous build, or one IPv4 /16 holds more than 5 % and more than 5 points over its previous share (lists of 200 or more entries).
• A VPN or Tor exit from anonymizers-7d.txt appears in any block list, firewall script, Suricata or Zeek file, the Defender CSV, a MISP ip-src with to_ids set or a STIX malicious-activity indicator.
• ipv4-added-1d.txt lists an address that is not in ipv4-7d.txt, or ipv4-removed-1d.txt one that still is.
• The snapshot is older than the published build (a rollback needs an explicit override; re-running the same snapshot republishes identical files).
• A Defender row or STIX indicator would already be expired on import.
• The lookup files under lookup/ do not hold exactly the addresses of the IP lists, each with its lists.
• Any file matches the private leak rules (sensor addresses, decoy hostnames, internal markers).
• A record fails the schema, or the STIX bundle has duplicate ids, missing properties or no TLP:CLEAR marking.

The size, churn and concentration checks are overridden, with a warning, when the previous day's snapshot already failed the same ones against the published build and this build is within limits of it: a shift that holds for two consecutive days is real, a one-day spike is not.

Domains, paths and user agents are filtered as well:

• Domains: popular sites (Tranco top 10k), code-hosting, paste and file-sharing services (dpaste, paste.ee, termbin, 0x0.st, GitHub raw and gist content and others) and public suffixes never appear in domains-7d.txt, though they can appear inside full URLs.
• User agents: attack tools and other non-browser clients are kept, including VPN clients (AnyConnect, GlobalProtect, F5 Access and others) that log in to VPN portals in brute-force runs; these are hunting leads, and zeek/mirage.intel and suricata/datasets/uas.lst leave them out. Dropped are browser strings (every product token is a browser one, such as Mozilla, AppleWebKit, Chrome, Safari, Firefox, Edg, OPR, UCBrowser or the like Gecko of Internet Explorer 11, including a bare Mozilla/5.0), HTTP libraries (curl, Wget, python-requests, Go-http-client, okhttp, axios, node-fetch, Java, libwww-perl, VLC and similar) and anything that names itself a bot, crawler, spider, scanner or research project or carries a contact URL or address. Named attack tools (zgrab, masscan, nuclei, sqlmap, gobuster, SIPVicious friendly-scanner and others) are kept even when they say "scanner".
• Paths: dropped are /, /robots.txt, /.well-known/* and common legitimate endpoints (login, admin, API, GraphQL, health, sitemap, WordPress login and AJAX, Exchange autodiscover, VPN portal start pages, MCP and others) in their simple variants, plus any path with an @ (other than /@vite/), a hex or base64 run of 16 or more characters or a /s/<token>/ segment, because those encode the scanned target. The decoy sites' own pages (/account, /billing, /settings, /webhooks, /admin/users, /admin/dashboard and similar, as whole path segments) are dropped unless the path carries an exploit pattern or ends in a file or dotfile (/settings/.env), and so are paths naming a research scanner (Bitsight, Internet Census, Censys, Shadowserver, Stretchoid). The Suricata path dataset is stricter still: it only holds paths tied to a CVE or with an exploit pattern (traversal, ;, %2e, ${, cgi-bin, /etc/passwd, shell metacharacters after .php? and known device exploit paths).

Most listed addresses are compromised devices or rented infrastructure. A listing means "this address attacked honeypots", not a judgement about whoever holds it.

Community feed and full feed

This repository is the community edition. It is free, and it stays free.

	Community (this repo)	Full feed
Update cadence	Daily, 24 h delayed	Real time (API, webhook, TAXII)
Attacker IPs	Multi-sensor, high confidence	Every source, incl. targeted single-sensor activity
Context per IP	ASN, country, tags	Ports, protocols, full session timeline
Payloads and commands	URLs and hashes	Decoded payloads, shell transcripts, stage-2 captures
Credentials	Top 100 passwords, no usernames	Full corpus of attempted credentials and captured hashes
Attribution	—	Actor clusters, campaigns, AI intent verdicts
History	7–30 days	365 days
Analysis	—	Ask Mirage natural-language queries
Exports	Daily files	STIX, MISP, CSV on demand

The full feed is available to OffSeq customers. Request a trial →

Verify a download

Paths in SHA256SUMS are relative to the feed root, so download files into the same layout:

base=https://feeds.offseq.com/mirage-feed
curl -fsSLO "$base/SHA256SUMS" -O "$base/SHA256SUMS.minisig"
minisign -Vm SHA256SUMS -P RWQeu/vC+HeSo+5whq+ViPiKFUe35GOuuVll6WA6QKlFNirw7IzweToA   # check the trusted comment
curl -fsSL --create-dirs -o latest/ipv4-7d.txt "$base/latest/ipv4-7d.txt"
sha256sum -c --ignore-missing SHA256SUMS        # macOS: shasum -a 256 -c --ignore-missing SHA256SUMS

The trusted comment reads mirage-feed <day> generated <snapshot time> build <build id> and is covered by the signature: check that the snapshot time is recent, so a mirror cannot pass off an old signed build as today's. The build id, also in feed.json and history.json, is the first 16 hex digits of the SHA-256 of the SHA256SUMS lines of every file but feed.json and history.json; it changes whenever a file does, so a republish of the same snapshot is told apart. The minisign public key is also published at https://feeds.offseq.com/.well-known/mirage-feed-minisign.pub. SHA256SUMS carries a GitHub build-provenance attestation; check that it came from this repository's publish workflow on main:

gh attestation verify SHA256SUMS -R offseq/mirage-feed --signer-workflow offseq/mirage-feed/.github/workflows/publish.yml --source-ref refs/heads/main

scripts/check-feed.sh runs all of this (signature, checksums, freshness and format) in one go.

If this blocks something you need

Allow the address locally first, so you are not waiting on us: put it in an exception alias or add an allow rule above the block rule. Then ask for removal through the removal form or at abuse@offseq.com. No GitHub account needed. Requests are handled within 72 hours and take effect in the next daily build. An address that resumes attacking is listed again.

Bug in a file format or an integration? Open an issue.

License

Data: CC BY 4.0. Credit "OffSeq Mirage" with a link to this repository. Code: MIT. Marked TLP:CLEAR.

The data is provided as is, without warranty. You decide what to block. Privacy notice: feeds.offseq.com/privacy.

---

OffSeq · European offensive security · Mirage · Research