HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors

port=800

100 unique IPs · 193 events · 14 countries · 17 ASNs

Activity · last 7d

2026-06-29: 10 events2026-06-30: 41 events2026-07-01: 40 events2026-07-02: 16 events2026-07-03: 13 events2026-07-04: 42 events2026-07-05: 31 events

peak 42 on 2026-07-04

Top source networks · click to refine

Refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP800GET /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
70 · 61 IPs71.6.134.234 →
HTTP800GET /favicon.ico
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
44 · 43 IPs71.6.134.234 →
HTTP800GET /.well-known/security.txt
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
5 · 5 IPs147.185.133.219 →
HTTP800GET /robots.txt
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Ed…
5 · 5 IPs118.193.56.171 →
HTTP800GET /sitemap.xml
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Ed…
5 · 5 IPs118.193.56.171 →
HTTP800POST /api/route
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
4 · 2 IPs160.119.71.92 →
HTTP800GET /config.json
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
4 · 4 IPs118.193.56.171 →
HTTP800POST /api
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
4 · 2 IPs160.119.71.92 →
HTTP800POST /_next/server
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
4 · 2 IPs160.119.71.92 →
HTTP800GET http://146.56.180.42:3333/
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
494.154.43.36 →
HTTP800POST /
UA: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0…
4 · 2 IPs160.119.71.92 →
HTTP800POST /_next
UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
4 · 2 IPs160.119.71.92 →
IPCountryASNTop portsEvents
Showing top 50 by event count. Window is the last 7d. Add or remove filters by clicking any value on a per-IP report.