Live data · free to read
Aggregate statistics from the sensors behind the SciScope Scanner Feed — published in full, with no key and no signup. This page is regenerated from the same bundle the API serves, so what you see here is what subscribers are getting.
Data generated · refreshed hourly
Ten entries from the live feed — the same records a subscriber's firewall is pulling right now. The full feed carries 18,456 of them, each with the evidence behind the verdict.
| address | score | cc | network | tags | last seen |
|---|---|---|---|---|---|
| 195.178.110.228 | 100 | AD | DMZHOST - TECHOFF SRV LIMITEDAS48090 | asn_drop corroborated | 2026-09-19 |
| 198.235.24.34 | 100 | US | GOOGLE-CLOUD-PLATFORM - Google LLCAS396982 | host:GCP | 2026-09-19 |
| 204.76.203.4 | 100 | DE | PFCLOUD - Pfcloud UG (haftungsbeschrankt)AS51396 | asn_drop corroborated host:Pfcloud | 2026-09-19 |
| 77.90.185.20 | 100 | DE | LimitedNetwork-AS - Limited Network LTDAS213790 | asn_drop corroborated | 2026-09-19 |
| 79.124.62.230 | 100 | SC | DM_AUTO - DM AUTO EOODAS207812 | asn_drop corroborated | 2026-09-19 |
| 192.161.49.2 | 96 | US | HOSTP-LA - HostPapaAS23273 | host:HostPapa | 2026-09-19 |
| 188.166.68.252 | 95 | NL | DIGITALOCEAN-ASN - DigitalOcean, LLCAS14061 | host:DigitalOcean | 2026-09-19 |
| 74.235.123.26 | 93 | US | MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft CorporationAS8075 | host:Azure | 2026-09-19 |
| 152.32.131.245 | 91 | HK | UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDAS135377 | host:UCloud | 2026-09-19 |
corroborated means an independent public list agrees with us. The rows without it are the point: 52% of the feed carries no outside corroboration at all (7-day average) — our sensors saw it and nobody else's list has it yet.
What the sensors recorded each day — firewall drops, SSH attempts and web probes.
Which ports the internet is knocking on, as a share of all events.
What kind of contact those events were.
Where the flagged addresses are registered — the traffic's origin, not our sensors'. Mostly rented infrastructure, so this reflects where hosting is cheap rather than anything about the countries themselves.
Where we observe from. Regions without a sensor are marked, and the gap is real: an operation that only scans one part of the world may not reach us yet.
Everything above comes from the API. Here is a real call and exactly what comes back.
# any key, including a Free one curl -s -H "Authorization: Bearer $SCISCOPE_KEY" \ https://api.sciscope.ee/v1/stats # -> { "generated_utc": "2026-09-19T22:35:34Z", "totals": { "scored_ips": 220692, "on_feed": 18456, "on_blocklist": 7383, "identified_crawlers": 206 }, "events_per_day_30d": [ /* 30 days */ ], "top_dst_ports_7d": [ /* 15 rows */ ], "event_types_7d": [ /* by volume */ ], "top_feed_countries": [ /* 15 rows */ ] }
# 198.51.100.24 is a documentation address (RFC 5737), used here as an example curl -s -H "Authorization: Bearer $SCISCOPE_KEY" \ https://api.sciscope.ee/v1/ip/198.51.100.24 # -> { "ip": "198.51.100.24", "found": true, "score": 87.4, "raw_score": 91.0, "sensor_continents": [ "Africa", "Europe" ], "signal_events_30d": 1284, "first_seen": "2026-07-09", "last_seen": "2026-07-28", "last_signal": "2026-07-28", "geo": { "country": "US", "asn": 64496, "as_org": "Example Hosting" }, "tags": [ "scanner", "ssh", "multi-sensor" ], "evidence": { /* per-continent: first and last seen, by day */ }, "updated_utc": "2026-09-19T22:35:34Z" }
Every flagged address ships with the evidence behind it. If you disagree with a verdict you can see precisely what produced it — which is the whole difference between a feed you can operate and a list you have to trust.
Get a key
A 14-day trial gives you the full Pro feature set — feed, history, per-IP lookups — with no card and no form. When it ends your key drops to Free rather than dying, so the statistics endpoint above keeps working indefinitely.