Blog · · HoneyLabs
Hello from HoneyLabs
A short tour of what we run, what is in the dataset, and what we plan to write about here.
What you're looking at
HoneyLabs runs a fleet of internet-facing honeypot sensors and ships the events into a public, query-ready dataset. Right now we have over 13 million events across SSH, HTTP, TLS, and raw-TCP probes.
This blog is where we will share findings from the data. A few examples of what we plan to write up:
- CVE probing waves. When a new exploit lands on Twitter, which IPs are first to start scanning the internet for it. Sometimes within hours.
- ASN heat maps. Which networks are quietly hosting most of the scanning traffic. Often more concentrated than you would expect.
- Bot fleet rotations. When a Mozi or Mirai variant goes dark and a new C&C address replaces it, the timing tells you something about who is operating it.
- Tool fingerprints. TLS JA4 and HTTP JA4H signatures cluster scanners into families. We will publish lookup tables when we find something useful.
How to use the data yourself
- /lookup for ad-hoc IP, ASN, port, or CVE queries with full boolean syntax.
- /feeds to turn any query into a daily digest email or a token-gated URL your firewall can pull.
- /mcp to wire HoneyLabs into Claude, Cursor, or any other MCP client and ask natural-language questions over the data.
The dataset is free for individual research use. We will publish writeups here as we find things worth sharing.