HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

76 unique IPs · 266 events · 10 countries · 16 ASNs

Activity · last 7d

2026-07-03: 40 events2026-07-04: 42 events2026-07-05: 17 events2026-07-06: 47 events2026-07-07: 48 events2026-07-08: 32 events2026-07-09: 40 events

peak 48 on 2026-07-07

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP20001GET /
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
81 · 54 IPs216.180.246.63 →
HTTP20001GET /favicon.ico
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
76 · 42 IPs216.180.246.63 →
TLS2000150 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a 0d 0a 53 4d 0d 0a 0d 0a …(57 bytes)17 · 17 IPs66.132.195.90 →
-20001d�6Ld�ގd���d�wFd��d��Rd��Xd�\�d��d� �{d� �qd� X�d� 2ed� ڧd���d�sod��d��)d…17 · 17 IPs66.132.195.90 →
HTTP20001GET /sitemap.xml
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
7 · 7 IPs66.132.172.207 →
HTTP20001GET /login
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
6 · 6 IPs216.180.246.63 →
HTTP20001GET /.well-known/security.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
5 · 5 IPs66.132.195.86 →
RDP20001/*�Cookie: mstshash=Administr 5152.53.81.25 →
HTTP20001GET /security.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
3 · 3 IPs66.132.195.90 →
HTTP20001GET /config.json
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
3 · 3 IPs165.154.164.114 →
TPKT20001TPKT / COTP (ISO-TSAP)03 00 00 0b 06 e0 00 00 00 00 003 · 3 IPs165.154.164.114 →
HTTP20001GET /robots.txt
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Ed…
3 · 3 IPs165.154.164.114 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.