HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

101 unique IPs · 209 events · 1 countries · 1 ASNs

Activity · last 7d

2026-07-07: 57 events2026-07-08: 13 events2026-07-09: 37 events2026-07-10: 29 events2026-07-11: 24 events2026-07-12: 24 events2026-07-13: 25 events

peak 57 on 2026-07-07

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP35300GET /76 · 67 IPs59.29.124.195 →
RDP3389/RDPRDP (X.224)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 03 00 00 0014 · 2 IPs112.166.31.254 →
-1433/MSSQL)�U�412125.141.30.201 →
-5555CNXN2����host::9 · 4 IPs119.194.132.136 →
HTTP5985POST /wsman
UA: Python WinRM client
8 · 4 IPs221.161.46.241 →
-1433/MSSQL)�U�6118.32.48.16 →
HTTP2375/DockerGET /version6221.157.134.75 →
-1433/MSSQL)�U 6222.112.181.190 →
-1433/MSSQL)�Uh6118.32.48.16 →
-1433/MSSQL)�U@(6118.44.65.173 →
HTTP2001POST /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.…
6210.217.42.139 →
-1433/MSSQL)�U�)6118.44.65.173 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.