HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

27 unique IPs · 32 events · 1 countries · 1 ASNs

Activity · last 7d

2026-07-22: 2 events2026-07-23: 4 events2026-07-24: 3 events2026-07-25: 8 events2026-07-26: 9 events2026-07-27: 1 events2026-07-28: 5 events

peak 9 on 2026-07-26

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP12167GET /16 · 15 IPs139.227.161.67 →
-1433/MSSQL12 01 00 34 00 00 00 00 00 00 15 00 06 01 00 1b 00 01 02 00 1c 00 0c 03 …(52 bytes)3139.227.140.158 →
Redis6379/Redis*1 $4 info2106.75.241.127 →
HTTP199GET /favicon.ico
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
2 · 2 IPs140.206.194.161 →
-1521/Oracle00 5a 00 00 01 00 00 00 01 36 01 2c 00 00 08 00 7f ff 7f 08 00 00 00 01 …(90 bytes)1223.167.206.153 →
-2222/SSHG�0~���1223.167.205.34 →
-402080\٬�������h�*���j��W_ܮp�2���!��|(�s��?-��PA����錜���E�A“�\���8�E}�ȋ+<д�Q�P�6���πa}��1�C���4�2~i�v ��%�ky�+���2:�X�P��I���Rz����C15 ��i\�����D���;T�ǠgS��2�hm�,���…1139.227.19.247 →
-3260/iSCSI52 4f 55 54 45 52 5f 41 44 4d 00 02 02 00 00 00 00 00 00 00 00 00 00 00 …(35 bytes)1140.206.194.173 →
-111/RPC�(�`����1139.227.161.191 →
HTTP8030GET /rs-status1139.227.161.200 →
RDP3389/RDPRDP (X.224)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 0b 00 00 001139.226.161.143 →
-40208BitTorrent protocol���:�)��ߩd������>�-XL0019-� ��ئꐋ��;1139.227.19.247 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.