iAnonymous lookups: 30/hr per source IP. Sign in (free) to watch an address, a network or your own prefix, turn a query into a feed your firewall polls, and get an API key for MCP / HTTP.

Threat lookup.

Search by IP, CIDR, ASN, or domain (partial OK). Free, no account. Or skim the live data below and click into any value to drill in.

tryport:445 proto:rdp port:102 AND NOT proto:http country:NL AND NOT tag:scanner ua:zgrab

query syntax

field:value pairs combined with AND, OR, NOT and parentheses. Case-insensitive keywords.

port:445 · country:NL · asn:14061 · cidr:80.82.77.0/24 · proto:rdp · cve:CVE-2017-0144 · ja4:… · ja3:… · hassh:… · domain:example.com · path:/wp-login.php · ua:zgrab · tag:scanner · header:x-forwarded-for · banner:SSH-2.0 · has:cert

Anonymous visitors can run single-field searches; boolean and text queries need a free account. The examples above are pre-authorized for everyone.

your IP

216.73.217.14 not observed

Or explore candidate campaign clusters, fingerprints carried by many IPs across only a handful of networks.

45.5M

events total

248.3K

24h

12.1K

last hour

9.4K

unique IPs / 24h

23.1K

ports targeted / 24h

101

countries / 24h

🇺🇸 US

top country

39131

top port

last event 9s ago · cached 5 min

Most active right now

top 10, last 7 days · click for full report

46.151.178.11 🇳🇱NL Sino Worldwide Trading Limited 5234 5185 6143 6437 5831 280.7K 64.34.80.225 🇺🇸US Latitude.sh 5172 5174 24678 5173 5171 68.5K 98.159.234.202tractatos.dreamsinheels.com 🇬🇧GB Datacamp Limited 100 340 391 260 273 38.5K 168.144.77.101 🇮🇳IN DigitalOcean, LLC 15671 48410 9418/Git 18992 2806 36.7K 157.245.163.64 🇺🇸US DigitalOcean, LLC 7733 6576 6643 3206 29196 29.3K 77.83.38.41hostingselling.com 🇺🇦UA Ayosoft Ltd 3389/RDP 29.2K 213.209.159.175 🇩🇪DE Feo Prest SRL 88 8090 80/HTTP 82 444 27.0K 93.123.109.214 🇧🇬BG Techoff Srv Limited 27017/MongoDB 21/FTP 443/HTTPS 4786/Cisco-SCM 3632 21.3K 93.174.93.12asm.group-ib.com 🇳🇱NL IP Volume inc 4001 9253 6501 7000 9012 14.6K 80.94.95.211 🇷🇴RO SS-Net 3000/Web-alt 80/HTTP 443/HTTPS 13.3K

CVEs being scanned right now

24h · top 8 of 1237 · 239 actively exploited · KEV = on CISA actively-exploited list

high

CVE-2021-43798KEVfind peers →

Grafana v8.x - Arbitrary File Read

2.6K

1 src IPs

high

CVE-2023-39141 find peers →

Aria2 WebUI - Path traversal

1.4K

1 src IPs

high

CVE-2019-7315 find peers →

Genie Access WIP3BVAF IP Camera - Local File Inclusion

1.4K

1 src IPs

high

CVE-2019-18922 find peers →

Allied Telesis AT-GS950/8 - Local File Inclusion

1.4K

1 src IPs

high

CVE-2022-38794 find peers →

Zaver - Local File Inclusion

1.4K

1 src IPs

high

CVE-2018-19326 find peers →

Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion

1.3K

1 src IPs

high

CVE-2010-4231 find peers →

Camtron CMNC-200 IP Camera - Directory Traversal

1.3K

1 src IPs

high

CVE-2020-24571 find peers →

NexusDB <4.50.23 - Local File Inclusion

1.3K

1 src IPs

Show all 1237 CVEs being probed in the last 7 days →

Most-seen fingerprints

copy any to your detection rules

SSH HASSH

24h · click to find peers

98ddc5604ef6a1006a2b49a58759fbe6487 / 5 IPs 5bd26477da5440a6187bd3f1b39a429c404 / 8 IPs 3356ae6145fa86124298066e281ea2d9117 / 3 IPs 7216c7c473918b4f83d1139b3c70dbf954 / 46 IPs 084386fa7ae5039bcf6f07298a05a22753 / 48 IPs

TLS JA4

24h · click to find peers

t13i131000_f57a46bbacb6_ab7e3b40a67710.6K / 1.7K IPs t13i190800_9dc949149365_97f8aa674fd99.9K / 771 IPs t13i1311h2_f57a46bbacb6_ab7e3b40a6779.5K / 6 IPs t13i251000_b78ed14e2fd0_ab7e3b40a6778.5K / 6 IPs t13i311100_e8f1e7e78f70_ccd0985badbe7.1K / 985 IPs

HTTP Akin

24h · click to find peers

b11cun030_00040014_03330a1838.1K / 1 IPs b11cun060_0004003d_f55b17ef18.7K / 3 IPs b11cun040_00040016_aa48e2c815.6K / 1.6K IPs b10cun020_00000014_0a8d7f1115.5K / 1.5K IPs b11cun040_00040013_608dab689.9K / 925 IPs

Live leaderboards

aggregated 24h

Query the dataset curl honeylabs.net/lookup/<ip> free, no auth · append ?format=json · same data over MCP + HTTP

MCP API docs Get a key

Free lookups rate-limited to 30/hr per source IP. Results cached 10 min per IP. Public dataset strips honeypot identity, full payload bytes, and credentials at the database layer. More about the dataset →