HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

17 unique IPs · 23 events · 3 countries · 3 ASNs

Activity · last 7d

2026-07-25: 3 events2026-07-27: 2 events2026-07-29: 1 events2026-07-30: 17 events

peak 17 on 2026-07-30

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP30475GET /
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
7 · 7 IPs147.185.132.221 →
HTTP30475POST /wsman
UA: Microsoft WinRM Client
2104.152.52.69 →
LDAP304750 `�1104.152.52.55 →
-30475OPTIONS rtsp://<HONEYPOT>/ RTSP/1.0 CSeq: 1 User-Agent: VLC media player/1.3.0 Accept: application/sdp1104.152.52.71 →
-3047500 00 00 6a fe 53 4d 42 40 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 …(110 bytes)1104.152.52.55 →
MQTT304750w�1.3.6.1.4.1.1466.200371104.152.52.55 →
-30475AMQP 1104.152.52.67 →
-30475f9 be b4 d9 76 65 72 73 69 6f 6e 00 00 00 00 00 56 00 00 00 69 79 94 66 …(110 bytes)1104.152.52.62 →
-30475/multistream/1.0.0 /tls/1.0.01104.152.52.55 →
-30475/ !"&�1104.152.52.61 →
HTTP30475GET /get_info
UA: curl/7.61.1
1104.152.52.56 →
-304753a 00 00 00 00 00 00 00 00 00 00 00 d4 07 00 00 00 00 00 00 61 64 6d 69 …(58 bytes)1104.152.52.69 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.