HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors

ASN=11878

4 unique IPs · 104 events · 1 countries · 1 ASNs

Activity · last 7d

2026-06-26: 13 events2026-06-27: 20 events2026-06-28: 9 events2026-06-29: 12 events2026-06-30: 10 events2026-07-01: 23 events2026-07-02: 11 events2026-07-03: 6 events

peak 23 on 2026-07-01

Top source networks · click to refine

Refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP2090GET /favicon.ico
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.3…
53 · 2 IPs198.44.137.54 →
HTTP18088GET /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
42 · 2 IPs198.44.137.54 →
HTTP443/HTTPSGET /.env.test
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
168.235.46.125 →
HTTP5061/SIPSOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TLS 130.51.22.249:64449;branch=z9hG4bK-782b8f7a-387f-421c-827a-ae78dcd78a56 From: <sip:100@<HONEYPOT>>;tag=6ed39a25-6e94-4735-b1ec…1130.51.22.249 →
HTTP5060/SIPOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TCP 130.51.22.249:6173;branch=z9hG4bK-744e13b8-5ca2-4653-8eb9-ab5cda0cee8f From: <sip:100@<HONEYPOT>>;tag=2ef72c89-b4de-4274-9c15-…1130.51.22.249 →
HTTP5061/SIPSOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TLS 130.51.22.249:27021;branch=z9hG4bK-0b0dfc04-1feb-4e0a-9dd0-2b81b97b2248 From: <sip:100@<HONEYPOT>>;tag=ee748e63-ab69-4117-b3af…1130.51.22.249 →
HTTP5061/SIPSOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TLS 130.51.22.249:20911;branch=z9hG4bK-c0e5829c-7c41-4a98-8d08-bc7f8b506945 From: <sip:100@<HONEYPOT>>;tag=7053b99b-4754-4a96-afbe…1130.51.22.249 →
HTTP5061/SIPSOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TLS 130.51.22.249:3423;branch=z9hG4bK-dad432bc-8e2b-47ce-9ce8-f739692073c9 From: <sip:100@<HONEYPOT>>;tag=e88a30d3-c483-4329-b1a2-…1130.51.22.249 →
HTTP5060/SIPOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TCP 130.51.22.249:36171;branch=z9hG4bK-5b7a9744-8a14-402b-b946-a71bb8a56a26 From: <sip:100@<HONEYPOT>>;tag=b46ce1d7-ce65-4107-8f2b…1130.51.22.249 →
HTTP5061/SIPSOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TLS 130.51.22.249:51857;branch=z9hG4bK-56ef1e59-bee8-4c27-9ace-8314a9554c01 From: <sip:100@<HONEYPOT>>;tag=83ed2364-b209-4eb7-be84…1130.51.22.249 →
HTTP5061/SIPSOPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/TLS 130.51.22.249:3553;branch=z9hG4bK-bc227caf-f468-40ff-b112-95b96b3cc018 From: <sip:100@<HONEYPOT>>;tag=3ff05ea6-3f9f-4411-9d82-…1130.51.22.249 →
IPCountryASNTop portsEvents
Showing top 50 by event count. Window is the last 7d. Add or remove filters by clicking any value on a per-IP report.