HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

28 unique IPs · 197 events · 10 countries · 12 ASNs

Activity · last 7d

2026-07-30: 12 events2026-07-31: 11 events2026-08-01: 8 events2026-08-02: 1 events2026-08-03: 157 events2026-08-04: 3 events2026-08-05: 5 events

peak 157 on 2026-08-03

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP887GET /25 · 19 IPs147.182.168.95 →
HTTP887GET /favicon.ico
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
14 · 8 IPs66.132.172.211 →
-8870d 0a 0d 0a7 · 4 IPs147.182.168.95 →
-887HELP6 · 3 IPs147.182.168.95 →
-887 6 · 3 IPs147.182.168.95 →
-88700 1e 00 06 01 00 00 01 00 00 00 00 00 00 07 76 65 72 73 69 6f 6e 04 62 …(32 bytes)6 · 3 IPs147.182.168.95 →
-887�(r����|6 · 3 IPs147.182.168.95 →
HTTP887OPTIONS / RTSP/1.06 · 3 IPs147.182.168.95 →
HTTP887OPTIONS /6 · 3 IPs147.182.168.95 →
HTTP887GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0
4192.161.49.2 →
RDP887/*�Cookie: mstshash=Administr 4 · 2 IPs185.156.73.157 →
RDP887TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 03 00 00 004194.180.49.104 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.