HoneyLabs
iAnonymous lookups: 10/min, 60/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors

query: asn:16509

2.3K unique IPs · 81.9K events · 11 countries · 1 ASNs

Activity · last 30d

2026-05-14: 2.2K events2026-05-15: 3.6K events2026-05-16: 3.0K events2026-05-17: 2.2K events2026-05-18: 2.3K events2026-05-19: 2.5K events2026-05-20: 2.2K events2026-05-21: 2.5K events2026-05-22: 2.3K events2026-05-23: 2.1K events2026-05-24: 2.2K events2026-05-25: 2.1K events2026-05-26: 2.2K events2026-05-27: 2.3K events2026-05-28: 2.4K events2026-05-29: 3.0K events2026-05-30: 2.7K events2026-05-31: 2.6K events2026-06-01: 1.3K events2026-06-02: 4.1K events2026-06-03: 3.5K events2026-06-04: 3.5K events2026-06-05: 3.7K events2026-06-06: 3.6K events2026-06-07: 2.6K events2026-06-08: 2.5K events2026-06-09: 2.1K events2026-06-10: 2.7K events2026-06-11: 3.4K events2026-06-12: 3.2K events2026-06-13: 1.3K events

peak 4.1K on 2026-06-02

Top source networks · click to refine

Refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP30443GET /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.3…
66.6K · 2.0K IPs54.219.135.52 →
-80030a11.4K · 1.1K IPs18.118.167.101 →
-443/HTTPS�% �����LR_ݪ�'*Ω�-391 · 29 IPs13.250.241.209 →
-445/SMB00 00 00 66 fe 53 4d 42 40 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 …(106 bytes)116 · 49 IPs18.222.11.78 →
-445/SMB00 00 00 2f ff 53 4d 42 72 00 00 00 00 18 43 c8 00 00 00 00 00 00 00 00 …(51 bytes)116 · 49 IPs18.222.11.78 →
-1433/MSSQL/ !"&�116 · 50 IPs3.135.20.12 →
-502ZG+113 · 44 IPs18.221.183.34 →
Redis6379/Redis*1 $4 PING112 · 51 IPs18.221.183.34 →
HTTP631/IPPPOST /ipp
UA: Mozilla/5.0 zgrab/0.x
111 · 45 IPs18.221.124.200 →
-1521/Oraclem8, A ��3:AA(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))110 · 48 IPs18.221.233.203 →
-27017/MongoDB3a 00 00 00 00 00 00 00 00 00 00 00 d4 07 00 00 00 00 00 00 61 64 6d 69 …(58 bytes)102 · 45 IPs18.191.31.217 →
-5432/Postgres�/90 · 35 IPs18.222.11.78 →
IPCountryASNTop portsEvents
Showing top 50 by event count. Window is the last 30d. Add or remove filters by clicking any value on a per-IP report.