Dataplane.org observes and publishes free Internet signals - helping operators, researchers, and analysts understand activity across the global network.
Each signal is a list of IP addresses observed exhibiting specific behaviors on the Internet - free to download and use for research, enrichment, and awareness. Signals are informational indicators; they are not recommended as direct block lists.
IP addresses observed sending recursive queries, IN ANY probes, DNS over TCP, and VERSION.BIND requests - indicators of scanning or misconfigured resolvers.
IP addresses observed attempting SSH password authentication and client connections - strong indicators of Internet-wide scanning and brute-force activity.
IP addresses observed sending unsolicited HELO/EHLO and DATA commands - useful for identifying hosts probing email infrastructure.
IP addresses observed sending unsolicited SIP REGISTER and INVITE requests - indicators of VoIP infrastructure scanning and potential toll fraud.
IP addresses observed attempting VNC authentication and Telnet logins - indicators of scans probing remote access and legacy services.
IP addresses observed in NTP version requests and IPv6 scanning - valuable data for understanding next-generation network behavior and abuse trends.
A broad range of open-source tools, commercial platforms, and research organizations rely on Dataplane.org signals. We make no recommendations for or against any listed organization.
Using our signals? Let us know.
Our standard signal feeds are free for everyone. If your team needs something more specific - a particular protocol, geography, delivery method, or cadence - we can build it.
Custom feeds are priced to sustain the infrastructure that powers our free public signals. Revenue from custom work directly funds the community data we provide at no cost.
Contact Us About Custom FeedsResponses typically within 1–2 business days
Dataplane.org runs a global observation network that continuously collects, processes, and publishes Internet behavior data - at no cost to anyone.
300+ passive sensors across 65 metro areas and 6 continents monitor unsolicited traffic - DNS, SSH, SMTP, SIP, VNC, Telnet, NTP, IPv6.
Raw observations are deduplicated, enriched with context, and categorized by behavior. Signal feeds are generated and refreshed every hour.
Signal feeds are freely published for anyone to download, integrate into research pipelines, or use for Internet-wide situational awareness.
Since 2016, Dataplane.org has provided free, independent Internet observation data to the community - no agenda, no vendor interest, just data.
As a 501(c)(3) organization, all signals, tools, and analysis are provided at no cost. No paywalls, no tiers, no vendor lock-in - ever.
300+ sensors across 65 metro areas on 6 continents provide a uniquely diverse perspective that regional solutions can't match.
Signals refresh every hour. Integrate into your SIEM, threat intelligence platform, or research workflows to stay current.
Used by 20+ leading security platforms and research tools including Recorded Future, Shadowserver, Team Cymru, and MISP.
Dataplane.org is a 501(c)(3) nonprofit. Every donation - large or small - sustains our global sensor network and keeps all signals free for the community, forever.
Our newsletter goes out when we have something worth saying - research findings, new signals, analysis of Internet anomalies, and organizational updates. No filler.