HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

31 unique IPs · 260 events · 9 countries · 13 ASNs

Activity · last 7d

2026-07-31: 26 events2026-08-01: 32 events2026-08-02: 8 events2026-08-03: 161 events2026-08-04: 26 events2026-08-05: 5 events2026-08-06: 2 events

peak 161 on 2026-08-03

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP17GET /
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
34 · 17 IPs216.180.246.192 →
HTTP17GET /favicon.ico
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
12 · 9 IPs216.180.246.89 →
-170d 0a 0d 0a9 · 5 IPs104.248.183.81 →
HTTP17OPTIONS /8 · 4 IPs104.248.183.81 →
HTTP17OPTIONS / RTSP/1.08 · 4 IPs104.248.183.81 →
-1700 1e 00 06 01 00 00 01 00 00 00 00 00 00 07 76 65 72 73 69 6f 6e 04 62 …(32 bytes)8 · 4 IPs104.248.183.81 →
-17�(r����|8 · 4 IPs104.248.183.81 →
-17HELP8 · 4 IPs104.248.183.81 →
-17 8 · 4 IPs104.248.183.81 →
RDP17TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 03 00 00 005194.180.49.104 →
TLS17l 4 · 4 IPs104.248.183.81 →
TLS17TLS/SSL16 03 00 00 69 01 00 00 65 03 03 55 1c a7 e4 72 61 6e 64 6f 6d 31 72 61 …(110 bytes)4 · 4 IPs104.248.183.81 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.