Honeypots and bulk upload

Upload thousands of addresses at once from a honeypot or log export.

Honeypots and log exports produce addresses in bulk. Instead of thousands of single requests, upload a CSV of up to 10,000 rows at once. Bulk upload needs an API key.

The file

Columns are IP,Categories,ReportDate,Comment; the header row is optional. Put several categories in quotes:

IP,Categories,ReportDate,Comment
203.0.113.50,"ssh,brute-force",2026-10-25T03:12:00Z,cowrie: 120 login attempts
198.51.100.7,port-scan,2026-10-25T04:40:10Z,scanned 1-65535
2001:db8::66,"telnet,iot,brute-force",,mirai-style telnet logins

Upload

curl -s "https://isipsafe.com/api/v1/bulk-report?key=$ISIPSAFE_KEY" -F [email protected]

The response tells you how many rows were saved and why any were rejected (bad address, unknown category, reported in the last 15 minutes):

{ "data": { "savedReports": 812, "invalidReports": [ { "error": "unknown category \"foo\"", "input": "198.51.100.4", "rowNumber": 14 } ] } }

Cowrie example

Turn a day of Cowrie JSON logs into an upload:

( echo "IP,Categories,ReportDate,Comment"
  jq -r 'select(.eventid=="cowrie.login.failed") | .src_ip' /var/log/cowrie/cowrie.json | sort | uniq -c | awk '$1>=3{printf "%s,\"ssh,brute-force\",,cowrie: %d failed logins\n", $2, $1}'
) > reports.csv && curl -s "https://isipsafe.com/api/v1/bulk-report?key=$ISIPSAFE_KEY" -F [email protected]

Need a hand?

If something here does not work with your version of Honeypots and bulk upload, or you have improved it, tell us. We update these pages with what people send.

Honeypots and bulk upload and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.