HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

50 unique IPs · 249 events · 7 countries · 10 ASNs

Activity · last 7d

2026-07-30: 2 events2026-07-31: 6 events2026-08-01: 16 events2026-08-02: 6 events2026-08-03: 18 events2026-08-04: 197 events2026-08-05: 2 events2026-08-06: 2 events

peak 197 on 2026-08-04

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP1250GET /
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
35 · 30 IPs205.210.31.86 →
RDP1250TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 03 00 00 0012 · 3 IPs103.134.75.62 →
-125000 1e 00 06 01 00 00 01 00 00 00 00 00 00 07 76 65 72 73 69 6f 6e 04 62 …(32 bytes)8 · 4 IPs45.33.73.114 →
HTTP1250OPTIONS / RTSP/1.08 · 4 IPs45.33.73.114 →
HTTP1250OPTIONS /8 · 4 IPs45.33.73.114 →
-1250�(r����|8 · 4 IPs45.33.73.114 →
-1250 8 · 4 IPs45.33.73.114 →
-1250HELP8 · 4 IPs45.33.73.114 →
-12500d 0a 0d 0a8 · 4 IPs45.33.73.114 →
LDAP12500 `�4 · 4 IPs45.33.73.114 →
TLS1250TNMPTNME4 · 4 IPs45.33.73.114 →
TLS1250l 4 · 4 IPs45.33.73.114 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.