HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

22 unique IPs · 316 events · 7 countries · 10 ASNs

Activity · last 7d

2026-07-19: 40 events2026-07-20: 55 events2026-07-21: 49 events2026-07-22: 42 events2026-07-23: 49 events2026-07-24: 36 events2026-07-25: 42 events2026-07-26: 3 events

peak 55 on 2026-07-20

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP51GET /
UA: Python/3.10 aiohttp/3.8.4
295 · 14 IPs80.82.77.202 →
HTTP51GET /favicon.ico
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
6 · 5 IPs93.174.93.34 →
-51GET http://146.56.180.42:3333/
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
494.154.43.36 →
HTTP51GET /aab9
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 · 2 IPs46.161.50.108 →
HTTP51GET /aaa9
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 · 2 IPs46.161.50.108 →
RDP51TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 03 00 00 002178.62.102.163 →
HTTP51GET /squid-internal-mgr/cachemgr.cgi
UA: Mozilla/5.0 zgrab/0.x
2178.128.158.73 →
-51�/1104.152.52.143 →
-51�<HONEYPOT>3185.237.212.146 →
-51�4�����@�� 180.82.77.202 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.