HoneyLabs
Lookup
Explore
CVEsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog
Dashboard
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

3.4K unique IPs · 181.6K events · 28 countries · 61 ASNs

Narrow it+ AND NOT tag:scanner+ AND country:CA+ AND port:58016+ AND NOT proto:http

Activity · last 7d

2026-07-12: 3.9K events2026-07-13: 27.5K events2026-07-14: 29.9K events2026-07-15: 29.2K events2026-07-16: 14.8K events2026-07-17: 15.0K events2026-07-18: 31.7K events2026-07-19: 29.7K events

peak 31.7K on 2026-07-18

Top source networks · click to refine

AS209334 Modat B.V.35.8%
AS398324 Censys, Inc.12.5%
AS6939 Hurricane Electric LLC11.9%
AS16509 Amazon.com, Inc.9.0%
query: ja4h:ge11nn0400_88d30a62b7ad×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP18245GET /
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
109.9K · 2.9K IPs66.132.186.181 →
HTTP5855GET /squid-internal-mgr/cachemgr.cgi
UA: Mozilla/5.0 zgrab/0.x
12.0K · 16 IPs64.227.99.233 →
HTTP5432/PostgresGET /favicon.ico
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36
6.7K · 1.2K IPs45.156.129.81 →
HTTP2222/SSHGET /login
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
3.1K · 634 IPs66.132.172.47 →
HTTP7776GET /robots.txt
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.36
2.8K · 450 IPs150.107.36.236 →
HTTP7776GET /.well-known/security.txt
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.36
2.5K · 370 IPs150.107.36.236 →
HTTP5901GET /sitemap.xml
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.4K · 357 IPs66.132.195.53 →
HTTP58462GET /security.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.4K · 358 IPs66.132.195.87 →
HTTP43199GET /wiki
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.2K · 361 IPs167.94.146.59 →
HTTP1887GET /manage/account/login
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
1.1K · 276 IPs216.180.246.70 →
HTTP1887GET /admin/index.html
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
1.0K · 275 IPs216.180.246.70 →
HTTP1887GET /index.html
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
985 · 272 IPs216.180.246.70 →
IPCountryASNTop portsEvents
167.172.206.254🇺🇸USAS14061 DigitalOcean, LLC4101 8101 5321 8011 572210.2K
85.217.149.3o004.scanner.modat.io🇨🇦CAAS209334 Modat B.V.4789 196 494 4370 504563.6K
85.217.149.7o008.scanner.modat.io🇨🇦CAAS209334 Modat B.V.32000 40310 56229 58016 241613.6K
18.116.101.220scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.10080 123/NTP 37810 25/SMTP 10243.5K
85.217.149.16o017.scanner.modat.io🇨🇦CAAS209334 Modat B.V.8186 14741 51391 38691 352463.3K
16.58.56.214scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.85 10002 1963 12321 80793.2K
85.217.149.8o009.scanner.modat.io🇨🇦CAAS209334 Modat B.V.56993 1063 25507 12394 289543.1K
85.217.149.29o030.scanner.modat.io🇨🇦CAAS209334 Modat B.V.5017 28688 5597 56001 557572.8K
18.218.118.203scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.52869 1337 30002 143/IMAP 181902.8K
85.217.149.20o021.scanner.modat.io🇨🇦CAAS209334 Modat B.V.51152 52850 7848 21237 157422.5K
3.130.168.2scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.4839 995/POP3S 8086/InfluxDB 8020 123212.5K
85.217.149.6o007.scanner.modat.io🇨🇦CAAS209334 Modat B.V.50547 13223 49491 49364 494122.5K
3.129.187.38scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.85 9091 7000 80/HTTP 80932.4K
85.217.149.15o016.scanner.modat.io🇨🇦CAAS209334 Modat B.V.65374 54193 54222 18065 37722.2K
85.217.149.14o015.scanner.modat.io🇨🇦CAAS209334 Modat B.V.17082 47825 2105 3598 630302.2K
85.217.149.59o059.scanner.modat.io🇨🇦CAAS209334 Modat B.V.15104 63112 61228 55464 550312.1K
85.217.149.2o003.scanner.modat.io🇨🇦CAAS209334 Modat B.V.51089 52087 7859 50734 93552.0K
85.217.149.57o057.scanner.modat.io🇨🇦CAAS209334 Modat B.V.64318 995/POP3S 41426 4668 82802.0K
85.217.149.21o022.scanner.modat.io🇨🇦CAAS209334 Modat B.V.8925 8908 4095 8486 87392.0K
85.217.149.12o013.scanner.modat.io🇨🇦CAAS209334 Modat B.V.45841 24329 61026 21935 278781.9K
85.217.149.13o014.scanner.modat.io🇨🇦CAAS209334 Modat B.V.26563 22721 186 43 238371.9K
85.217.149.30o031.scanner.modat.io🇨🇦CAAS209334 Modat B.V.23002 9259 7568 7698 76231.9K
64.227.99.2333f3e2d2b9e.research-scanner.com🇺🇸USAS14061 DigitalOcean, LLC1492 5855 14975 7786 67821.7K
85.217.149.10o011.scanner.modat.io🇨🇦CAAS209334 Modat B.V.21702 22855 10061 21550 217561.4K
85.217.149.32o033.scanner.modat.io🇨🇦CAAS209334 Modat B.V.39806 44822 5958 47476 392671.4K
85.217.149.23o024.scanner.modat.io🇨🇦CAAS209334 Modat B.V.30458 47 30455 58016 119211.3K
85.217.149.28o029.scanner.modat.io🇨🇦CAAS209334 Modat B.V.28456 47781 5230 5592 395981.3K
85.217.149.34o035.scanner.modat.io🇨🇦CAAS209334 Modat B.V.45591 42846 33532 33835 494451.2K
85.217.149.9o010.scanner.modat.io🇨🇦CAAS209334 Modat B.V.19243 53172 65184 51949 91641.2K
85.217.149.5o006.scanner.modat.io🇨🇦CAAS209334 Modat B.V.26874 49846 35806 11737 104801.1K
85.217.149.11o012.scanner.modat.io🇨🇦CAAS209334 Modat B.V.24665 29290 124 4750 433801.0K
167.94.146.6363.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.6697 1912 37446 43908 389/LDAP1.0K
167.94.146.5656.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.58690 50001 55615 22822 487661.0K
85.217.149.18o019.scanner.modat.io🇨🇦CAAS209334 Modat B.V.2207 7859 35888 60335 245081.0K
167.94.146.5959.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.10572 8866 93 43199 506071.0K
167.94.146.6161.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.6006 6000/X11 335 33987 36006987
85.217.149.25o026.scanner.modat.io🇨🇦CAAS209334 Modat B.V.44004 39732 31569 30780 26297979
85.217.149.0o001.scanner.modat.io🇨🇦CAAS209334 Modat B.V.2294 64282 60678 54726 53608978
167.94.146.4848.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.53096 9510 37762 25899 38341973
167.94.146.5757.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.50106 46832 2082 44267 48853964
167.94.146.5050.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.53282 63502 45399 28461 42281952
167.94.146.5353.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.64806 64147 8883 1111 64117943
167.94.146.5151.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.61295 48813 6699 24895 18789933
167.94.146.4949.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.4282 8883 20547 45251 8443/HTTPS-alt931
167.94.146.5454.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.39301 4678 22841 40102 43620931
167.94.146.5252.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.45874 5672 10260 37409 18082921
167.94.146.5858.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.51472 2405 13976 56516 14757916
85.217.149.31o032.scanner.modat.io🇨🇦CAAS209334 Modat B.V.7850 51536 51549 8606 51205908
167.94.146.5555.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.2762 20120 22918 44830 4617905
3.131.220.121scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.18190 37215 8079 91 8729903
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.