HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog
Dashboard
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

94 unique IPs · 156 events · 6 countries · 13 ASNs

Narrow it+ AND NOT tag:scanner+ AND country:US+ AND port:102

Activity · last 7d

2026-07-19: 28 events2026-07-20: 17 events2026-07-21: 20 events2026-07-22: 27 events2026-07-23: 16 events2026-07-24: 26 events2026-07-25: 18 events2026-07-26: 4 events

peak 28 on 2026-07-19

Top source networks · click to refine

AS396982 Google LLC26.9%
AS398324 Censys, Inc.17.9%
AS6939 Hurricane Electric LLC14.7%
AS8075 Microsoft Corporation11.5%
query: proto:s7comm×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 04 00 c1 02 01 00 c2 02 01 02 c0 01 0a69 · 68 IPs198.235.24.115 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 01 00 c0 01 0d c2 02 00 01 c1 02 00 0124 · 24 IPs66.132.186.201 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 04 00 c1 02 01 00 c2 02 02 00 c0 01 0a21 · 21 IPs198.235.24.115 →
S7comm102*%�� AAAAAAAAAAAA� BBBBBBBBBBBB�21 · 16 IPs64.62.156.182 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 01 00 c0 01 0a c1 02 01 00 c2 02 01 023 · 2 IPs62.210.90.215 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 14 00 c1 02 01 00 c2 02 01 02 c0 01 0a3185.242.226.93 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 05 00 c1 02 01 00 c2 02 02 00 c0 01 0a3185.242.226.93 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 19 02 f0 80 32 01 00 00 02 00 00 08 00 00 f0 00 00 01 00 01 01 …(25 bytes)3 · 3 IPs91.230.168.2 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 02 00 c1 02 02 00 c2 02 02 00 c0 01 0a145.156.128.59 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 0b 06 e0 00 00 00 01 00193.174.95.106 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 05 00 c1 02 02 00 c2 02 02 01 c0 01 0a145.156.128.59 →
S7comm102S7comm / COTP (ISO-TSAP)03 00 00 16 11 e0 00 00 00 01 00 c1 02 00 00 c2 02 00 01 c0 01 0a145.156.128.57 →
IPCountryASNTop portsEvents
185.242.226.93security.criminalip.com🇺🇸USAS202425 IP Volume inc1026
45.156.128.59sh-ams-nl-gp1-wk112d.internet-census.org🇵🇹PTAS211680 Sistemas Informaticos, S.A.1024
64.62.156.182scan-86-0.shadowserver.io🇺🇸USAS6939 Hurricane Electric LLC1023
205.210.31.60🇺🇸USAS396982 Google LLC1022
199.45.154.112112.154.45.199.censys-scanner.com🇺🇸USAS398722 Censys, Inc.1022
205.210.31.138🇺🇸USAS396982 Google LLC1022
198.235.24.114🇺🇸USAS396982 Google LLC1022
147.185.132.126🇺🇸USAS396982 Google LLC1022
198.235.24.115🇺🇸USAS396982 Google LLC1022
199.45.154.119119.154.45.199.censys-scanner.com🇺🇸USAS398722 Censys, Inc.1022
66.132.224.7979.224.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
147.185.132.87🇺🇸USAS396982 Google LLC1022
199.45.155.6565.155.45.199.censys-scanner.com🇺🇸USAS398722 Censys, Inc.1022
66.132.172.196196.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
66.132.172.191191.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
66.132.195.7777.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
65.49.1.202scan-76-00.shadowserver.io🇺🇸USAS6939 Hurricane Electric LLC1022
167.94.146.5454.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.1022
198.235.24.19🇺🇸USAS396982 Google LLC1022
199.45.155.103103.155.45.199.censys-scanner.com🇺🇸USAS398722 Censys, Inc.1022
198.235.24.98🇺🇸USAS396982 Google LLC1022
64.62.156.222scan-90-0.shadowserver.io🇺🇸USAS6939 Hurricane Electric LLC1022
167.94.146.5151.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.1022
66.132.172.103103.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
66.132.224.9191.224.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
66.132.172.137137.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
147.185.132.16🇺🇸USAS396982 Google LLC1022
193.46.255.159🇷🇴ROAS47890 Unmanaged Ltd1022
66.132.186.201201.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
198.235.24.234🇺🇸USAS396982 Google LLC1022
147.185.132.61🇺🇸USAS396982 Google LLC1022
216.218.206.68scan-07.shadowserver.io🇺🇸USAS6939 Hurricane Electric LLC1022
199.45.155.9595.155.45.199.censys-scanner.com🇺🇸USAS398722 Censys, Inc.1022
147.185.132.73🇺🇸USAS396982 Google LLC1022
167.94.146.6161.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.1022
66.132.172.143143.172.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
205.210.31.45🇺🇸USAS396982 Google LLC1022
205.210.31.177🇺🇸USAS396982 Google LLC1022
66.132.195.5858.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
198.235.24.73🇺🇸USAS396982 Google LLC1022
45.156.128.57sh-ams-nl-gp1-wk112b.internet-census.org🇵🇹PTAS211680 Sistemas Informaticos, S.A.1022
147.185.132.84🇺🇸USAS396982 Google LLC1022
66.132.195.4646.195.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
62.210.90.2159270e4b6-8b0b-4488-b565-730ea5ea5a92.fr-par-1.baremetal.scw.clou🇫🇷FRAS12876 Scaleway SAS1022
167.94.146.4848.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.1022
66.132.186.174174.186.132.66.censys-scanner.com🇺🇸USAS398324 Censys, Inc.1022
199.45.154.145145.154.45.199.censys-scanner.com🇺🇸USAS398722 Censys, Inc.1022
205.210.31.218🇺🇸USAS396982 Google LLC1022
147.185.132.115🇺🇸USAS396982 Google LLC1022
205.210.31.220🇺🇸USAS396982 Google LLC1022
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.