HoneyLabs
iAnonymous lookups: 10/min, 60/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors

query: asn:51396

206 unique IPs · 38.7K events · 3 countries · 1 ASNs

Activity · last 30d

2026-05-14: 849 events2026-05-15: 3.8K events2026-05-16: 1.5K events2026-05-17: 593 events2026-05-18: 1.0K events2026-05-19: 710 events2026-05-20: 531 events2026-05-21: 2.1K events2026-05-22: 280 events2026-05-23: 2.1K events2026-05-24: 2.2K events2026-05-25: 684 events2026-05-26: 1.8K events2026-05-27: 570 events2026-05-28: 465 events2026-05-29: 832 events2026-05-30: 784 events2026-05-31: 723 events2026-06-01: 697 events2026-06-02: 897 events2026-06-03: 3.6K events2026-06-04: 863 events2026-06-05: 3.7K events2026-06-06: 2.4K events2026-06-07: 2.0K events2026-06-08: 503 events2026-06-09: 410 events2026-06-10: 627 events2026-06-11: 760 events2026-06-12: 587 events2026-06-13: 210 events

peak 3.8K on 2026-05-15

Top source networks · click to refine

Refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
SOCKS51080/SOCKSSOCKS505 01 0010.4K · 24 IPs192.109.200.13 →
HTTP20144CONNECT proxy2.proxiesfood.com:443 HTTP/1.1 Host: proxy2.proxiesfood.com:4439.4K · 9 IPs204.76.203.226 →
HTTP85GET /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/9…
4.1K · 47 IPs204.76.203.212 →
SSH47557SSH-2.0-OpenSSH1.8K · 11 IPs176.65.149.220 →
HTTP8081CONNECT httpbin.org:443 HTTP/1.1 Host: httpbin.org:443 Proxy-Connection: keep-alive1.4K45.135.193.193 →
HTTP4000GET /anthropic/v1/models
UA: Mozilla/5.0 (compatible; scanner/1.0)
561176.65.148.38 →
-5555CNXN2����host::525 · 12 IPs45.135.194.83 →
HTTP4000GET /proxy/anthropic/v1/models
UA: Mozilla/5.0 (compatible; scanner/1.0)
504176.65.148.38 →
HTTP80/HTTPGET /SDK/webLanguage
UA: Mozilla/5.0
497 · 2 IPs204.76.203.219 →
HTTP8097GET http://proxy.flarevpn.digital:8080/judge
UA: Go-http-client/1.1
37245.135.194.113 →
HTTP8080/HTTP-altGET /login
UA: Go-http-client/1.1
368 · 19 IPs176.65.139.177 →
-80/HTTP1111  �adminqueryBasicCfg<?xml version="1.0" encoding…334 · 4 IPs176.65.139.165 →
IPCountryASNTop portsEvents
Showing top 50 by event count. Window is the last 30d. Add or remove filters by clicking any value on a per-IP report.