HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

23 unique IPs · 411 events · 4 countries · 7 ASNs

Activity · last 7d

2026-07-19: 45 events2026-07-20: 68 events2026-07-21: 65 events2026-07-22: 55 events2026-07-23: 61 events2026-07-24: 56 events2026-07-25: 56 events2026-07-26: 5 events

peak 68 on 2026-07-20

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP1293GET /
UA: Python/3.10 aiohttp/3.8.4
394 · 14 IPs80.82.77.202 →
HTTP1293GET /favicon.ico
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
9 · 8 IPs80.82.70.40 →
-1293�4�����@�� 480.82.77.202 →
HTTP1293GET /squid-internal-mgr/cachemgr.cgi
UA: Mozilla/5.0 zgrab/0.x
2 · 2 IPs198.211.98.87 →
HTTP1293GET /aab9
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
146.161.50.108 →
HTTP1293GET /aaa9
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
146.161.50.108 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.