HoneyLabs
Lookup
Explore
CVEsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog
Dashboard
iAnonymous lookups: 10/min, 60/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors

ASN=202425

45 unique IPs · 15.0K events · 2 countries · 1 ASNs

Activity · last 7d

2026-06-24: 537 events2026-06-25: 2.8K events2026-06-26: 2.3K events2026-06-27: 2.3K events2026-06-28: 1.9K events2026-06-29: 2.4K events2026-06-30: 1.8K events2026-07-01: 909 events

peak 2.8K on 2026-06-25

Top source networks · click to refine

AS202425 IP Volume inc100.0%
ASN: 202425×window1h24h7d30d🔒90d🔒
Refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP7777/OracleGET /
UA: Python/3.10 aiohttp/3.8.4
14.4K · 42 IPs80.82.77.202 →
HTTP119/NNTPGET /favicon.ico
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
207 · 7 IPs93.174.95.106 →
TLS88890a83 · 4 IPs89.248.167.131 →
HTTP60000GET HTTP://ip-api.com/ HTTP/1.02189.248.168.36 →
HTTP8545POST /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36
17 · 3 IPs185.242.226.103 →
HTTP27017/MongoDBGET /aab9
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1380.82.77.202 →
HTTP27017/MongoDBGET /aaa9
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1380.82.77.202 →
HTTP443/HTTPSGET /.well-known/security.txt10 · 3 IPs80.82.77.33 →
HTTP443/HTTPSGET /sitemap.xml10 · 3 IPs80.82.77.33 →
HTTP443/HTTPSGET /robots.txt10 · 3 IPs80.82.77.33 →
-9600/Logstash46 49 4e 53 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 008 · 3 IPs93.174.95.106 →
HTTP5984/CouchDBGET /_all_dbs
UA: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
8185.242.226.92 →
IPCountryASNTop portsEvents
80.82.77.202rnd.group-ib.com🇳🇱NLAS202425 IP Volume inc2715 50050 6379/Redis 5900/VNC 7777/Oracle8.8K
94.102.49.155🇳🇱NLAS202425 IP Volume inc2715 50050 6379/Redis 5900/VNC 7777/Oracle4.2K
80.82.77.33sky.census.shodan.io🇳🇱NLAS202425 IP Volume inc37777 8098 11 502 9100/Printer219
80.82.77.139dojo.census.shodan.io🇳🇱NLAS202425 IP Volume inc60030 25001 19 3542 15177
93.174.95.106battery.census.shodan.io🇳🇱NLAS202425 IP Volume inc5601/Kibana 6666 4567 2379 119/NNTP131
89.248.167.131mason.census.shodan.io🇳🇱NLAS202425 IP Volume inc7777/Oracle 7171 1024 23/Telnet 8889125
185.242.226.81security.criminalip.com🇺🇸USAS202425 IP Volume inc40869 40845 40898 40897 40883108
185.242.226.8security.criminalip.com🇺🇸USAS202425 IP Volume inc8771 8745 8731 8732 874373
185.242.226.85security.criminalip.com🇺🇸USAS202425 IP Volume inc2107 2134 2123 2130 210371
185.242.226.91security.criminalip.com🇺🇸USAS202425 IP Volume inc7822 8068 7900 8078 807469
185.242.226.60security.criminalip.com🇺🇸USAS202425 IP Volume inc5209 5431 5111 5100 515165
185.242.226.90security.criminalip.com🇺🇸USAS202425 IP Volume inc5267 5270 5257 5266 526465
94.102.49.125🇳🇱NLAS202425 IP Volume inc1443 20443 30443 2443 1044364
185.242.226.61security.criminalip.com🇺🇸USAS202425 IP Volume inc9950 10134 9990 9743 986162
185.242.226.104security.criminalip.com🇺🇸USAS202425 IP Volume inc40920 40939 40949 40921 4093761
185.242.226.72security.criminalip.com🇺🇸USAS202425 IP Volume inc7465 7535 7415 7444 749360
185.242.226.71security.criminalip.com🇺🇸USAS202425 IP Volume inc59121 55100 57345 56881 5894659
185.242.226.9security.criminalip.com🇺🇸USAS202425 IP Volume inc9399 9410 9393 9441 940058
185.242.226.95security.criminalip.com🇺🇸USAS202425 IP Volume inc8343 8388 8340 8382 835057
185.242.226.126security.criminalip.com🇺🇸USAS202425 IP Volume inc8057 8097 8104 8093 808542
185.242.226.103security.criminalip.com🇺🇸USAS202425 IP Volume inc2013 5954 5952 5950 854540
185.242.226.11security.criminalip.com🇺🇸USAS202425 IP Volume inc12221 12223 12219 12218 1222038
93.174.93.12rnd.group-ib.com🇳🇱NLAS202425 IP Volume inc80/HTTP33
185.242.226.93security.criminalip.com🇺🇸USAS202425 IP Volume inc5007 47001 25565/Minecraft 502 2020132
185.242.226.73security.criminalip.com🇺🇸USAS202425 IP Volume inc9095 9099 9101 9102 909826
185.242.226.59security.criminalip.com🇺🇸USAS202425 IP Volume inc40000 554 389/LDAP 44818 1777725
94.102.49.193cloud.census.shodan.io🇳🇱NLAS202425 IP Volume inc11000 80/HTTP 2624
185.242.226.87security.criminalip.com🇺🇸USAS202425 IP Volume inc9005 9003 9600/Logstash 8200 900423
89.248.168.36🇳🇱NLAS202425 IP Volume inc6000021
185.242.226.74security.criminalip.com🇺🇸USAS202425 IP Volume inc20870 636/LDAPS 548 83 6200121
185.242.226.17security.criminalip.com🇺🇸USAS202425 IP Volume inc5985 143/IMAP 22/SSH 7547/TR-069 8419
185.242.226.92security.criminalip.com🇺🇸USAS202425 IP Volume inc9042/Cassandra 5984/CouchDB 6379/Redis 916018
185.242.226.110security.criminalip.com🇺🇸USAS202425 IP Volume inc80/HTTP14
80.82.77.48🇳🇱NLAS202425 IP Volume inc7070 5001 58888 1080/SOCKS 3133714
185.242.226.18security.criminalip.com🇺🇸USAS202425 IP Volume inc3000/Web-alt 445/SMB 818113
185.242.226.58security.criminalip.com🇺🇸USAS202425 IP Volume inc10000/Webmin 2000010
185.242.226.33security.criminalip.com🇺🇸USAS202425 IP Volume inc5001 3389/RDP 8443/HTTPS-alt7
185.242.226.19security.criminalip.com🇺🇸USAS202425 IP Volume inc8880 1723/PPTP6
185.242.226.70security.criminalip.com🇺🇸USAS202425 IP Volume inc443/HTTPS3
93.174.93.34🇳🇱NLAS202425 IP Volume inc50050 1080/SOCKS2
185.242.226.80security.criminalip.com🇺🇸USAS202425 IP Volume inc80/HTTP2
94.102.49.128🇳🇱NLAS202425 IP Volume inc27151
94.102.63.23🇳🇱NLAS202425 IP Volume inc1080/SOCKS1
89.248.171.23rnd.group-ib.com🇳🇱NLAS202425 IP Volume inc27151
89.248.172.33🇳🇱NLAS202425 IP Volume inc500501
Showing top 50 by event count. Window is the last 7d. Add or remove filters by clicking any value on a per-IP report.