HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

92 unique IPs · 257 events · 7 countries · 9 ASNs

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP16369GET /favicon.ico
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
224 · 61 IPs66.132.195.87 →
HTTP12407GET /
UA: curl/7.64.1
29 · 28 IPs8.216.5.142 →
HTTP443/HTTPSPROPFIND / HTTP/1.1 Host: <HONEYPOT>:443 User-Agent: - Connection: close Referer: http://<HONEYPOT>:443/246.151.178.13 →
HTTP443/HTTPSGET /restgui/js/services/resturi.js
UA: Go-http-client/1.1
1176.65.148.142 →
HTTP4430GET /cgi-bin/luci/;stok=/locale185.25.172.249 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 1h. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.