LEGACY: Sinkhole6 HTTP Drone Report

LAST UPDATED:  2021-06-07


Report discontinued. Replaced by: Sinkhole HTTP Events Report.

This report lists the IPv6 addresses for all the devices that connected to our IPv6 Sinkhole server.

Since the Sinkhole server is only accessed through previously malicious domain names, only infected systems or security researchers should be seen in this list.

For a list of tags supported please visit the  Sinkhole HTTP Drone Report.

Please note this report will be replaced after 2021-06-01 by Sinkhole HTTP Events Report.


  • timestamp
    Timestamp in UTC+0 the IPv6 IP accessed the sinkhole system
  • src_ip
    IPv6 address that accessed the sinkhole
  • src_asn
    ASN of the IPv6 IP accessing the sinkhole
  • src_geo
    Country location of the IPv6 IP accessing the sinkhole
  • src_region
    Region of the IPv6 IP accessing the sinkhole
  • src_port
    TCP source port
  • dst_ip
    Destination/sinkhole IP
  • dst_asn
    ASN of the destination/sinkhole IP
  • dst_geo
    Country location of the destination/sinkhole IP
  • dst_region
    Region of the destination/sinkhole IP
  • dst_port
    TCP destination port
  • protocol
    Protocol used to perform the connection
  • tag
    Description of the malware/infection that is causing the IP to communicate with the sinkhole
  • hostname
    PTR record of the IPv6 address that accessed the sinkhole
  • sysdesc
    System description
  • sysname
    Operating system
  • http_url
    HTTP request
  • http_agent
    HTTP User Agent
  • http_host
    Content of the HTTP Host: header; normally the fully qualified domain name of the C&C
  • http_referer
    Content of the HTTP Referer: header
  • http_referer_ip
    IP of the HTTP referer
  • http_referer_asn
    ASN of the IP of the HTTP referer
  • http_referer_geo
    Country of the IP of the HTTP referer
  • http_referer_region
    Region of the IP of the HTTP referer
  • forwarded_by
    HTTP Proxy header: if the FORWARDED_FOR header is present, the src_ip is set to the FORWARDED_FOR ip and the forwarded_by field is set to the client's IP


"2017-04-13 00:00:00","2405:205:148e:c034:790f:a853:511d:4288",237,"IN",,50713,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:00","2405:204:5288:d4e6::1709:30ad",237,"IN",,56706,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:00","2405:205:a02d:8b6b::1967:b8a1",237,"IN",,38979,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:00","2404:160:a410:2c77:1:1:dda8:249",10030,"MY",,46193,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:00","2800:4f0:6b:5450:24d8:3201:13e3:2747",237,"EC",,48756,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:01","2405:205:4208:92da::40a:8ad",237,"IN",,60217,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:01","2804:d49:d01:c900:7a52:1aff:fe7b:71bf",237,"BR",,53992,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:01","2804:d45:2d16:7c00:115a:51cd:7b93:4b8c",237,"BR",,52836,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,
"2017-04-13 00:00:01","2800:370:77:4760:805:a672:fb1d:e1df",26613,"EC",,38586,"2a02:1668:1034::2",51088,"NL",,80,,"ghost-push",,,,"POST /aum/api/1/ HTTP/1.1",,"u.amobisc.com",,,,,,

Our 128 Report Types