HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

3.5K unique IPs · 286.8K events · 23 countries · 59 ASNs

Activity · last 7d

2026-07-03: 5.7K events2026-07-04: 39.4K events2026-07-05: 35.1K events2026-07-06: 34.4K events2026-07-07: 53.1K events2026-07-08: 40.7K events2026-07-09: 34.9K events2026-07-10: 43.5K events

peak 53.1K on 2026-07-07

Top source networks · click to refine

Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP8789GET /
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
185.2K · 2.9K IPs216.180.246.139 →
HTTP355GET /squid-internal-mgr/cachemgr.cgi
UA: Mozilla/5.0 zgrab/0.x
30.9K · 22 IPs157.230.26.229 →
HTTP8789GET /favicon.ico
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
7.1K · 1.3K IPs216.180.246.139 →
HTTP8789GET /login
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
3.7K · 646 IPs216.180.246.139 →
HTTP5870GET /robots.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
3.0K · 440 IPs66.132.172.194 →
HTTP19532GET /.well-known/security.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.8K · 366 IPs167.94.146.58 →
HTTP113GET /sitemap.xml
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.6K · 357 IPs66.132.172.136 →
HTTP51677GET /security.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.4K · 359 IPs167.94.146.50 →
HTTP2403GET /wiki
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.2K · 329 IPs66.132.195.92 →
HTTP8789GET /manage/account/login
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
1.8K · 279 IPs216.180.246.139 →
HTTP8789GET /admin/index.html
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
1.7K · 280 IPs216.180.246.139 →
HTTP8789GET /index.html
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
1.6K · 282 IPs216.180.246.139 →
IPCountryASNTop portsEvents
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.