HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

44 unique IPs · 59 events · 7 countries · 9 ASNs

Activity · last 7d

2026-07-24: 2 events2026-07-25: 5 events2026-07-26: 13 events2026-07-27: 3 events2026-07-28: 13 events2026-07-29: 7 events2026-07-30: 9 events2026-07-31: 7 events

peak 13 on 2026-07-26

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP8602GET /
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
35 · 30 IPs35.203.210.27 →
HTTP8602GET /favicon.ico
UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
9 · 9 IPs91.230.168.72 →
HTTP8602GET /.well-known/security.txt
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
3 · 3 IPs147.185.132.206 →
HTTP8602GET /manage/account/login
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
2 · 2 IPs216.180.246.236 →
HTTP8602GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0
2192.161.49.2 →
TLS8602fox a 1 -1 fox hello { fox.version=s:1.0 id=i:1 hostName=s:xpvm-0omdc01xmy hostAddress=s:192.168.1.125 app.name=s:Workbench app.version=s:3.7.44 vm.name=s:Java HotSpot(TM) Server V…2143.198.122.74 →
-860234 00 00 00 01 00 00 00 00 00 00 00 dd 07 00 00 00 00 00 00 00 1f 00 00 …(52 bytes)2143.198.122.74 →
Redis8602*1 $4 PING1143.198.122.74 →
Redis8602*1 $4 INFO1143.198.122.74 →
Redis8602*1 $11 NONEXISTENT1143.198.122.74 →
-86023a 00 00 00 00 00 00 00 00 00 00 00 d4 07 00 00 00 00 00 00 61 64 6d 69 …(58 bytes)1143.198.122.74 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.