Mirage Feed: daily honeypot threat intelligence from OffSeq

Name

mirage-feed - daily attacker indicators from the OffSeq Mirage honeypot fleet

Handshake-verified attacker IPs, exploited CVEs, payload URLs and tool fingerprints, rebuilt every day in the formats firewalls, SIEMs and threat-intel platforms already read. Free to use under CC BY 4.0, marked TLP:CLEAR.

Synopsis

One address per line, no comments. Paths are stable; contents change daily.

Status

Snapshot of 2026-10-22, built 2026-10-23 20:18 UTC.

1,566

of 8,250 source IPs seen in the last 24 hours are in the feed

Every address Mirage saw attacking in the last 24 hours counts as seen. Those in the feed have passed the listing rules. The gap is what the full feed holds.

Feed lists cover the last 7 days of activity (30 days for ipv4-30d.txt).

Subscribe

Point your tool at a stable URL. Files are rebuilt every day; the paths never change.

Plain lists hold one value per line with no comments, so they load as-is into pfBlockerNG, OPNsense aliases, FortiGate threat feeds and Palo Alto EDLs.

Files

Full checksums in SHA256SUMS. Index as JSON: feed.json. Mirrors: feeds.offseq.com/mirage-feed/, raw.githubusercontent.com/offseq/mirage-feed/data/.

Integration

config system external-resource
    edit "mirage-feed"
        set type address
        set resource "https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt"
        set refresh-rate 1440
    next
end

/tool fetch url="https://feeds.offseq.com/mirage-feed/latest/mikrotik/mirage-7d.rsc" dst-path=mirage.rsc
/import file-name=mirage.rsc

curl --create-dirs -fsSLo /etc/nftables.d/mirage.nft https://feeds.offseq.com/mirage-feed/latest/nft/mirage.nft
nft -f /etc/nftables.d/mirage.nft

curl -fsSL https://feeds.offseq.com/mirage-feed/latest/ipset/mirage.ipset | ipset restore
iptables -C INPUT -m set --match-set mirage4 src -j DROP 2>/dev/null \
  || iptables -I INPUT -m set --match-set mirage4 src -j DROP
ip6tables -C INPUT -m set --match-set mirage6 src -j DROP 2>/dev/null \
  || ip6tables -I INPUT -m set --match-set mirage6 src -j DROP

curl -fsSL https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt -o mirage.txt
cscli decisions import -i mirage.txt --format values --duration 48h --scope ip --reason mirage-feed

alert ip any any -> $HOME_NET any (msg:"Mirage feed: known attacker"; iprep:src,MirageAttacker,>,50; sid:1900001; rev:1;)

redef Intel::read_files += { "/opt/mirage/mirage.intel" };

How an IP gets listed

An address is published only when all of these hold:

1. It completed a TCP handshake and sent application data. UDP-only and spoofable traffic never qualifies.
2. At least 3 Mirage sensors in at least 2 networks saw it within 7 days. One-off hits stay out.
3. It is not a known research scanner, CDN, public resolver, bogon or any range on the MISP warninglists.
4. Its first sighting is at least 24 hours old.

Entries expire 7 days after the last observed activity; new activity renews them. Research scanners are excluded from the blocklists and published separately in known-scanners-ipv4.txt and known-scanners-ipv6.txt, so you can allowlist them.

Before every publish, the build is rejected if the list overlaps an allowlist, contains anything wider than a /32, or changes size by more than 30% from the previous day.

Most listed addresses are compromised devices or rented infrastructure. A listing means "this address attacked honeypots", not a judgement about whoever holds it.

Community feed and full feed

This feed is free and stays free. The full feed is part of OffSeq Mirage.

Verify a download

Every build ships SHA256SUMS and a minisign signature over it.

Download into the same paths as the feed, so the names match the checksum file:

curl -fsSLO https://feeds.offseq.com/mirage-feed/SHA256SUMS -O https://feeds.offseq.com/mirage-feed/SHA256SUMS.minisig
curl --create-dirs -fsSLo latest/ipv4-7d.txt https://feeds.offseq.com/mirage-feed/latest/ipv4-7d.txt
minisign -Vm SHA256SUMS -P RWQeu/vC+HeSo+5whq+ViPiKFUe35GOuuVll6WA6QKlFNirw7IzweToA
sha256sum -c --ignore-missing SHA256SUMS

On macOS, use shasum -a 256 -c in place of sha256sum -c.

Removal

If your address is listed and should not be, use the removal form or write to abuse@offseq.com. No GitHub account needed. Requests are handled within 72 hours. An address that resumes attacking is listed again.

A bug in a file format or an integration? Open an issue.

See also

privacy, github.com/offseq/mirage-feed, record.schema.json, OffSeq research, FIRST TLP 2.0