HoneyLabs
Lookup
Explore
CVEsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog
Dashboard
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

4.1K unique IPs · 65.7K events · 17 countries · 38 ASNs

Narrow it+ AND NOT tag:scanner+ AND country:US+ AND port:443+ AND NOT proto:http

Activity · last 7d

2026-07-12: 416 events2026-07-13: 9.0K events2026-07-14: 9.7K events2026-07-15: 8.1K events2026-07-16: 10.1K events2026-07-17: 8.8K events2026-07-18: 10.5K events2026-07-19: 9.1K events

peak 10.5K on 2026-07-18

Top source networks · click to refine

AS396982 Google LLC32.9%
AS398324 Censys, Inc.32.2%
AS398705 Censys, Inc.22.7%
AS45102 Alibaba (US) Technology Co., Ltd.5.2%
query: ja4:t13i131000_f57a46bbacb6_ab7e3b40a677×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP1963GET /favicon.ico
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
39.3K · 388 IPs167.94.146.56 →
HTTP3443GET /
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
23.6K · 3.6K IPs205.210.31.176 →
HTTP443/HTTPSPROPFIND / HTTP/1.1 Host: <HONEYPOT>:443 User-Agent: - Connection: close Referer: http://<HONEYPOT>:443/10146.151.178.13 →
HTTP2087GET /openid_connect/cpanelid
UA: Go-http-client/1.1
56 · 2 IPs45.198.224.5 →
HTTP2087POST /login/?login_only=1
UA: Go-http-client/1.1
56 · 2 IPs45.198.224.5 →
HTTP443/HTTPSGET /.env
UA: More Internet Explorer 9.0 user agents strings -->>
49 · 3 IPs80.94.95.211 →
HTTP443/HTTPSGET /api/.env
UA: More Internet Explorer 9.0 user agents strings -->>
30 · 3 IPs80.94.95.211 →
HTTP443/HTTPSGET /app/.env
UA: More Internet Explorer 9.0 user agents strings -->>
30 · 3 IPs80.94.95.211 →
HTTP443/HTTPSGET /backend/.env
UA: More Internet Explorer 9.0 user agents strings -->>
30 · 3 IPs80.94.95.211 →
HTTP8443/HTTPS-altGET /.git/config
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120.0.0.0
30 · 7 IPs34.34.103.195 →
HTTP443/HTTPSGET /.env.local
UA: More Internet Explorer 9.0 user agents strings -->>
30 · 3 IPs80.94.95.211 →
HTTP443/HTTPSGET /.env.production
UA: More Internet Explorer 9.0 user agents strings -->>
29 · 3 IPs80.94.95.211 →
IPCountryASNTop portsEvents
34.34.103.195195.103.34.34.bc.googleusercontent.com🇳🇱NLAS396982 Google LLC443/HTTPS 8443/HTTPS-alt1.5K
167.94.146.6363.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.6697 1912 37446 43908 389/LDAP1.0K
167.94.146.5656.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.58690 50001 55615 22822 487661.0K
167.94.146.5959.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.10572 8866 93 43199 50607998
167.94.146.6161.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.6006 6000/X11 335 33987 36006982
167.94.146.4848.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.53096 9510 37762 25899 38341969
167.94.146.5757.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.50106 46832 2082 44267 48853960
167.94.146.5050.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.53282 63502 45399 28461 42281949
167.94.146.5353.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.64806 64147 8883 1111 64117937
167.94.146.5151.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.61295 48813 6699 24895 18789929
167.94.146.4949.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.4282 8883 20547 45251 8443/HTTPS-alt927
167.94.146.5252.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.45874 5672 10260 37409 18082916
167.94.146.5858.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.51472 2405 13976 56516 14757909
167.94.146.5555.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.2762 20120 22918 44830 4617904
167.94.146.5454.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.39301 4678 22841 40102 43620897
167.94.146.6262.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.81 33923 56975 36760 830852
167.94.146.6060.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.34413 5666 52462 2087 15785799
151.243.150.222🇩🇪DEAS209413 Dedik Services Limited443/HTTPS555
80.94.95.211🇷🇴ROAS204428 SS-Net443/HTTPS438
46.151.178.13🇳🇱NLAS211443 Sino Worldwide Trading Limited3000/Web-alt 8080/HTTP-alt 80/HTTP 443/HTTPS 3001138
66.132.195.6060.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.63203 63070 2181 4242 1904135
66.132.195.5252.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.6004 1912 49635 12211 250130
66.132.224.228228.224.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.455 1801 445/SMB 38971 46435129
66.132.195.5050.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.49729 28618 8912 3066 2095127
66.132.186.181181.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.8886 18245 58517 1962 2646125
66.132.195.8282.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.59432 35341 6729 22556 1402123
66.132.195.4848.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.27017/MongoDB 3299 46114 14090 13277122
66.132.172.208208.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.5901 57854 10260 37163 49201120
66.132.186.198198.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.44394 4123 4841 22922 32433120
66.132.186.203203.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.8803 42208 10252 808 2537119
66.132.172.204204.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.12754 29208 35936 11487 30120118
66.132.224.7979.224.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.40193 18728 2003 1963 832117
66.132.186.187187.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.8883 7443 4418 27927 22715116
66.132.172.210210.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.8081 47573 42571 22522 45751115
66.132.172.189189.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.28080 10259 1098 26257 2628115
66.132.195.5151.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.58603 46236 32387 12584 11102115
66.132.186.199199.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.12633 19454 1224 38499 1962114
66.132.172.137137.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.10250 41795 11300 49048 10001114
66.132.195.7575.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.28923 9142 44817 23324 63334114
66.132.195.6161.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.40675 41795 11300 49000 23208114
66.132.172.3737.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.101 139/SMB 1963 445/SMB 20546113
66.132.195.3434.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.58603 50580 36113 51243 20381112
66.132.195.8989.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.47754 7547/TR-069 14864 9200/Elastic 46036111
66.132.186.159159.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.19030 8602 5061/SIPS 832 19999110
45.198.224.5🇺🇸USAS215925 Vpsvault.host Ltd2087110
66.132.186.204204.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.12747 27941 51125 64225 8085110
66.132.172.9696.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.18244 50364 37348 8181 8888/HTTP-alt110
66.132.186.184184.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.51200 62660 23397 27052 51005110
66.132.172.193193.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.113 17022 2000 59902 119/NNTP109
66.132.172.138138.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.16096 53841 4841 21462 6362109
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.