HoneyLabs

Open-source honeypot telemetry. Query-ready.

We run honeypots that get probed by the internet all day. Everything they see is searchable here, 90 days back. Type an IP and see what it's been up to.

No IP to hand? See what's been probing us right now or browse the lookup landing.

$curl honeylabs.net/lookup/<ip>·
Use it from your AI agent:Claude Code →Add to CursorInstall in VS Codeall clients →
Or browse by tag
-
events total
-
24h
-
unique IPs / 24h
-
countries / 24h
-
top port / 24h
-
top country / 24h

Top countries

24h · click to filter
loading…

Top ASNs

24h · click for full report
loading…

Top ports

24h · click for full report
loading…

Top scanner hosts

24h · rDNS · click to filter
loading…

Top user-agents

24h · click to filter
loading…

Top TLS JA4

24h · click to find peers
loading…

Top SSH HASSH

24h · click to find peers
loading…

Top HTTP JA4H

24h · click to find peers
loading…

Emerging campaigns

Fingerprints carried by many IPs but few networks and ports.

…
loading…
loading…

Three ways to query it

free · no authGET /lookup/<ip>

Browser or curl

Any public IPv4. Returns HTML in browsers, JSON for curl / wget / explicit Accept header, or append ?format=json.

curl https://honeylabs.net/lookup/<ip>

Rate limited to 30 requests per minute per source IP. No account.

AI agents · MCPPOST /mcp

From Claude, Cursor, or anything

Streamable HTTP transport. Seven tools covering attacker enrichment, fingerprint search, payload search, and time-series.

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer <key>"

Free tier: 500 credits/day. Pro: 50k/day with 90-day history. 1 credit = 1 row of data returned. Get a key from the dashboard.

HTTP · JSON-RPC 2.0POST /mcp

Direct API for your own code

Skip the MCP client. POST a JSON-RPC envelope, get an SSE response back. Same bearer auth as the MCP tab.

curl -X POST https://mcp.honeylabs.net/mcp \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Use tools/list to enumerate, tools/call to invoke. Standard MCP wire format.

Recently active scanners

Top sources our honeypots logged in the past 7 days. Click any IP for the full report.