api.knock-knock.net

Attacker Intelligence API

Every IP that touches this honeypot is, by definition, scanning or attacking servers on the open internet. This API lets you check your own address space against that data. If one of your IPs comes back listed, a device on your network — a workstation, a VoIP phone, a router, an appliance — was caught attacking us, and is almost certainly compromised. The same foothold that lets it attack strangers sits inside your perimeter, next to your data, your credentials, and everything else it can reach — the last place you want an attacker-controlled machine. Each hit includes a per-protocol breakdown (which honeypots it hit, how many times, and when), so you learn not just that a device is misbehaving but what kind of activity it's generating.

Free, no API key, JSON over HTTPS — edit any example below and press Run to query it live.

Endpoints

{
  "list": "year",
  "generated_at": "2026-08-04T04:44:00Z",
  "asn": 21811,
  "isp": "Build-A-Bear Workshop, Inc.",
  "hit_count": 1,
  "total_matched": 1,
  "truncated": false,
  "hits": [
    {
      "ip": "104.238.197.106",
      "hits": 11,
      "first_seen": "2026-08-01 21:44:56",
      "last_seen": "2026-08-03 06:01:49",
      "protocols": [
        {
          "proto": "SIP",
          "hits": 11,
          "last_seen": "2026-08-03 06:01:49"
        }
      ]
    }
  ]
}

{
  "list": "year",
  "generated_at": "2026-08-04T04:44:00Z",
  "ranges_checked": [
    "2.57.121.0/24"
  ],
  "total_ips_checked": 256,
  "hit_count": 2,
  "total_matched": 2,
  "truncated": false,
  "hits": [
    {
      "ip": "2.57.121.25",
      "hits": 20000,
      "first_seen": "2026-04-18 17:33:04",
      "last_seen": "2026-07-05 14:11:29",
      "protocols": [
        {
          "proto": "SSH",
          "hits": 20000,
          "last_seen": "2026-07-05 14:11:29"
        }
      ]
    },
    {
      "ip": "2.57.121.112",
      "hits": 24555,
      "first_seen": "2026-04-18 17:32:50",
      "last_seen": "2026-08-04 04:42:55",
      "protocols": [
        {
          "proto": "SSH",
          "hits": 24555,
          "last_seen": "2026-08-04 04:42:55"
        }
      ]
    }
  ]
}

{
  "ip": "104.238.197.106",
  "listed": true,
  "hits": 11,
  "first_seen": "2026-08-01 21:44:56",
  "last_seen": "2026-08-03 06:01:49",
  "country": "United States",
  "isp": "Build-A-Bear Workshop, Inc.",
  "asn": 21811,
  "banned": false,
  "ban_until": null,
  "protocols": [
    {
      "proto": "SIP",
      "hits": 11,
      "last_seen": "2026-08-03 06:01:49"
    }
  ]
}

Every response carries generated_at (the snapshot age) and an exact total_matched count. Live queries here count against the same rate limits as the API itself.

Rate limits

Rate limits are high enough that they won't be triggered under ordinary use. Two things are counted: how many calls you make, and how many IPs those calls return — so a query against a large network counts more heavily than a small one, and ranges that come back clean barely register.

Batch to go faster: check-ranges takes up to 10 comma-separated CIDRs per call, so auditing 2,000 ranges is 200 calls, not 2,000.

If you do hit a limit, the 429 response names which limit you reached and how long until it resets, and carries a Retry-After header. A rejected request never counts toward any limit.

What "listed" means for you

A hit is observed attack traffic — the strongest kind of signal: a device on your network reached out and attacked a server it had no business touching. The protocol breakdown points you at the compromise — an IP hitting SSH hundreds of times reads very differently from one probing SIP for toll fraud. Pull the device, check it, rotate its credentials.

Prefer a static list for your firewall instead of live lookups? See the attacker IP blocklists — the same data as plain-text feeds for CSF, CrowdSec, ipset, nftables and pfSense.