One person, a fleet of sensors and a public record
HoneyLabs is run by Stefan Grimminck from the Netherlands. It puts sensors on the public internet that answer as exposed servers, keeps what unsolicited traffic does to them, and publishes the result in the formats a security team already reads.
The idea it was built on
Most threat intelligence is a list of addresses. An address is the cheapest thing an attacker owns: it is rented by the hour, rotated at will, and blocking it moves the problem rather than solving it. What is expensive to change is the client itself, which is why the sensors record how a request was constructed rather than only where it came from. A fingerprint survives the rotation, so a crowd of addresses collapses into one operator.
That is also why the sensors answer rather than listen. A honeypot that only logs a connection learns that someone knocked. One that answers as the server being hunted learns what the attacker intended to do next: the payload, the second-stage URL, the credentials, the file.
The data it publishes
Everything the sensors record is published. Some of it is free to anyone with no account at all, including the two feeds that ship inside MISP's own default feed set, and the rest sits behind a free key or a plan. There is a page of figures stating exactly what the corpus holds and how each number is measured.
What is never published is anything about the sensors themselves: how many there are, where they sit, what they answer as, or when any of them started. A honeypot that announces itself stops working, and a reader who can locate the fleet can poison it.
Two things it refuses
It does not sell data about the people who use it. There is no third-party analytics, no tag manager and no font host on this site, which the privacy page says in as many words. The only thing measured is which pages are read, first-party, on our own server.
It does not take a payment it cannot honour. Plans are monthly and cancel in the dashboard, the free tier is permanent rather than a trial, and academic, CERT and independent research run on a free research plan.
The person behind it
Stefan Grimminck. The company is an eenmanszaak, a Dutch sole proprietorship, registered with the Chamber of Commerce. That is a deliberate shape: no investors to answer to, no runway that ends, and no pressure to turn an intelligence product into an advertising one. It also means the person reading support@honeylabs.net is the person who wrote the code.
The work in the open sits on GitHub: the sensor agent, the Splunk app, the MISP and OpenCTI integrations and the Safe-IOC draft now in front of the IETF. Findings go out as posts on the blog and on infosec.exchange when the data says something worth saying.
The data is the argument
Read the figures, pull a feed, or look up an address you are seeing right now. None of it needs a card.