HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

105 unique IPs · 886 events · 7 countries · 9 ASNs

Activity · last 24h

2026-07-29: 291 events2026-07-30: 595 events

peak 595 on 2026-07-30

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP8602GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0
533 · 3 IPs192.161.49.2 →
HTTP9501GET /
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.2623.112 Safari/537.36
280 · 92 IPs115.231.78.11 →
HTTP30475GET /get_info
UA: curl/7.61.1
49 · 37 IPs104.152.52.56 →
HTTP80/HTTPGET /.git/config
UA: Mozilla/5.0 (compatible; Scanner/1.0)
4 · 2 IPs165.227.20.212 →
HTTP443/HTTPSGET /Dr0v
UA: -
4185.12.59.118 →
HTTP443/HTTPSGET /resolve?name=1.odns.m.dnsmeasure.top&type=A
UA: Go-http-client/1.1
4 · 2 IPs8.209.96.179 →
HTTP443/HTTPSGET /?name=1.odns.m.dnsmeasure.top&type=A
UA: Go-http-client/1.1
4 · 2 IPs8.209.96.179 →
HTTP443/HTTPSGET /query?name=1.odns.m.dnsmeasure.top&type=A
UA: Go-http-client/1.1
4 · 2 IPs8.209.96.179 →
HTTP443/HTTPSGET /dns-query?name=1.odns.m.dnsmeasure.top&type=A
UA: Go-http-client/1.1
4 · 2 IPs8.209.96.179 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 24h. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.