api.knock-knock.net

Attacker Intelligence API

Every IP that touches this honeypot is, by definition, scanning or attacking servers on the open internet. This API lets you check your own address space against that data. If one of your IPs comes back listed, a device on your network — a workstation, a VoIP phone, a router, an appliance — was caught attacking us, and is almost certainly compromised. The same foothold that lets it attack strangers sits inside your perimeter, next to your data, your credentials, and everything else it can reach — the last place you want an attacker-controlled machine. Each hit includes a per-protocol breakdown (which honeypots it hit, how many times, and when), so you learn not just that a device is misbehaving but what kind of activity it's generating.

Free, no API key, JSON over HTTPS — edit any example below and press Run to query it live.

Endpoints

{
  "list": "year",
  "generated_at": "2026-08-04T04:44:00Z",
  "asn": 21811,
  "isp": "Build-A-Bear Workshop, Inc.",
  "hit_count": 1,
  "total_matched": 1,
  "truncated": false,
  "hits": [
    {
      "ip": "104.238.197.106",
      "hits": 11,
      "first_seen": "2026-08-01 21:44:56",
      "last_seen": "2026-08-03 06:01:49",
      "protocols": [
        {
          "proto": "SIP",
          "hits": 11,
          "last_seen": "2026-08-03 06:01:49"
        }
      ]
    }
  ]
}

{
  "list": "year",
  "generated_at": "2026-08-04T04:44:00Z",
  "ranges_checked": [
    "2.57.121.0/24"
  ],
  "total_ips_checked": 256,
  "hit_count": 2,
  "total_matched": 2,
  "truncated": false,
  "hits": [
    {
      "ip": "2.57.121.25",
      "hits": 20000,
      "first_seen": "2026-04-18 17:33:04",
      "last_seen": "2026-07-05 14:11:29",
      "protocols": [
        {
          "proto": "SSH",
          "hits": 20000,
          "last_seen": "2026-07-05 14:11:29"
        }
      ]
    },
    {
      "ip": "2.57.121.112",
      "hits": 24555,
      "first_seen": "2026-04-18 17:32:50",
      "last_seen": "2026-08-04 04:42:55",
      "protocols": [
        {
          "proto": "SSH",
          "hits": 24555,
          "last_seen": "2026-08-04 04:42:55"
        }
      ]
    }
  ]
}

{
  "ip": "104.238.197.106",
  "listed": true,
  "hits": 11,
  "first_seen": "2026-08-01 21:44:56",
  "last_seen": "2026-08-03 06:01:49",
  "country": "United States",
  "isp": "Build-A-Bear Workshop, Inc.",
  "asn": 21811,
  "banned": false,
  "ban_until": null,
  "protocols": [
    {
      "proto": "SIP",
      "hits": 11,
      "last_seen": "2026-08-03 06:01:49"
    }
  ]
}

Every response carries generated_at (the snapshot age) and an exact total_matched count. Live queries here count against the same rate limits as the API itself.

Rate limits

Generous, per source IP — no key needed. A rejected request returns 429 with a Retry-After header and never counts against your quota.

What "listed" means for you

A hit is observed attack traffic — the strongest kind of signal: a device on your network reached out and attacked a server it had no business touching. The protocol breakdown points you at the compromise — an IP hitting SSH hundreds of times reads very differently from one probing SIP for toll fraud. Pull the device, check it, rotate its credentials.

Prefer a static list for your firewall instead of live lookups? See the attacker IP blocklists — the same data as plain-text feeds for CSF, CrowdSec, ipset, nftables and pfSense.