HoneyLabs
Lookup
Explore
CVEsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog
Dashboard
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors · live query

Edit and re-run: add AND country:NL, OR port:3389, NOT tag:scanner  ·  full syntax

5.1K unique IPs · 452.6K events · 11 countries · 27 ASNs

Narrow it+ AND country:CA+ AND port:22227+ AND NOT proto:http

Activity · last 7d

2026-07-04: 48.0K events2026-07-05: 55.3K events2026-07-06: 63.4K events2026-07-07: 77.5K events2026-07-08: 68.7K events2026-07-09: 61.2K events2026-07-10: 68.0K events2026-07-11: 10.5K events

peak 77.5K on 2026-07-07

Top source networks · click to refine

AS209334 Modat B.V.44.3%
AS398324 Censys, Inc.13.9%
AS398705 Censys, Inc.9.1%
AS213412 ONYPHE SAS8.0%
tag: scanner×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP4943GET /
UA: Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
218.0K · 3.7K IPs85.217.149.65 →
TLS59200a69.7K · 724 IPs85.217.140.10 →
HTTP7560GET /favicon.ico
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
60.0K · 1.7K IPs66.132.172.98 →
TLS4481850 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a 0d 0a 53 4d 0d 0a 0d 0a …(57 bytes)13.7K · 382 IPs66.132.172.132 →
HTTP7560GET /login
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
3.7K · 636 IPs66.132.172.98 →
HTTP26034GET /.well-known/security.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.3K · 356 IPs167.94.146.56 →
HTTP4093GET /sitemap.xml
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.3K · 357 IPs167.94.146.56 →
HTTP44818GET /robots.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.3K · 360 IPs66.132.172.132 →
HTTP58997GET /security.txt
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.3K · 346 IPs167.94.146.54 →
HTTP59982GET /wiki
UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
2.2K · 331 IPs167.94.146.57 →
HTTP5985POST /wsman
UA: python-requests/2.27.1
1.9K · 164 IPs44.220.185.245 →
HTTP1887GET /manage/account/login
UA: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)
1.7K · 273 IPs216.180.246.143 →
IPCountryASNTop portsEvents
85.217.140.54o353.scanner.modat.io🇫🇷FRAS209334 Modat B.V.58388 59339 35760 58544 118038.0K
85.217.149.27o028.scanner.modat.io🇨🇦CAAS209334 Modat B.V.12304 25252 55541 30129 299384.8K
80.82.77.202rnd.group-ib.com🇳🇱NLAS202425 IP Volume inc4001 9042/Cassandra 7000 2375/Docker 7777/Oracle4.3K
85.217.149.35o036.scanner.modat.io🇨🇦CAAS209334 Modat B.V.22734 41379 47275 21263 469864.3K
85.217.149.42o042.scanner.modat.io🇨🇦CAAS209334 Modat B.V.45520 4263 35304 6018 59314.2K
18.116.101.220scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.8082 9080 22227 1433/MSSQL 45004.1K
16.58.56.214scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.631/IPP 8092 1963 4433 222273.9K
85.217.140.15o315.scanner.modat.io🇫🇷FRAS209334 Modat B.V.18089 13775 23644 19011 384393.7K
31.14.32.6n302.scanner.modat.io🇳🇱NLAS201401 NewVM B.V.49656 7765 458 30564 502913.6K
85.217.149.20o021.scanner.modat.io🇨🇦CAAS209334 Modat B.V.52958 62951 1234 6645 278633.5K
18.218.118.203scan.visionheight.com🇺🇸USAS16509 Amazon.com, Inc.85 4443 631/IPP 8092 82913.2K
85.217.140.6o306.scanner.modat.io🇫🇷FRAS209334 Modat B.V.55282 27124 35354 11919 492693.1K
85.217.140.20o320.scanner.modat.io🇫🇷FRAS209334 Modat B.V.26863 31958 9459 48571 412682.8K
85.217.140.30o329.scanner.modat.io🇫🇷FRAS209334 Modat B.V.65301 52867 5920 18279 534942.8K
167.94.146.5454.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.40552 49175 58997 9600/Logstash 122752.7K
167.94.146.6161.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.50805 57161 2405 8413 8088/Hadoop2.7K
167.94.146.4949.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.14293 5000/Web-alt 33386 45467 458912.7K
85.217.140.5o305.scanner.modat.io🇫🇷FRAS209334 Modat B.V.9378 9412 387 9377 216312.7K
167.94.146.5858.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.43958 61130 46008 55615 86362.6K
167.94.146.5151.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.30750 24065 55480 8067 145882.6K
167.94.146.5757.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.17736 719 59982 3390 221222.6K
85.217.149.19o020.scanner.modat.io🇨🇦CAAS209334 Modat B.V.54072 53931 54079 53958 538932.6K
167.94.146.5252.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.5672 22340 47214 31471 267762.6K
167.94.146.6363.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.10056 14693 43 27234 1433/MSSQL2.6K
167.94.146.5959.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.42065 18225 8545 5413 8443/HTTPS-alt2.6K
167.94.146.6060.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.12854 8883 61259 3389/RDP 96012.6K
85.217.149.9o010.scanner.modat.io🇨🇦CAAS209334 Modat B.V.51560 54044 29234 55844 293452.5K
85.217.149.28o029.scanner.modat.io🇨🇦CAAS209334 Modat B.V.23047 54148 54425 82 195232.5K
85.217.149.17o018.scanner.modat.io🇨🇦CAAS209334 Modat B.V.3811 53433 18113 18168 533762.5K
167.94.146.5353.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.49906 20284 62766 56645 4272.5K
85.217.149.14o015.scanner.modat.io🇨🇦CAAS209334 Modat B.V.63250 47522 63703 46020 30402.5K
167.94.146.5050.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.25268 6539 59071 38959 343122.5K
167.94.146.5555.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.16216 11322 21867 8687 633242.5K
85.217.149.18o019.scanner.modat.io🇨🇦CAAS209334 Modat B.V.53106 25177 47322 3130 543852.4K
167.94.146.5656.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.52952 44488 26034 5475 40932.4K
167.94.146.4848.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.31700 15037 48800 9600/Logstash 325422.4K
167.94.146.6262.146.94.167.censys-scanner.com🇺🇸USAS398705 Censys, Inc.60823 50054 20353 18682 228062.4K
85.217.149.23o024.scanner.modat.io🇨🇦CAAS209334 Modat B.V.38703 57722 31301 37778 420792.4K
85.217.149.55o055.scanner.modat.io🇨🇦CAAS209334 Modat B.V.32806 6440 33110 58911 74472.4K
85.217.149.33o034.scanner.modat.io🇨🇦CAAS209334 Modat B.V.12848 31764 55095 14431 436742.4K
85.217.149.34o035.scanner.modat.io🇨🇦CAAS209334 Modat B.V.5225 1485 18097 1398 546122.4K
85.217.140.2o302.scanner.modat.io🇫🇷FRAS209334 Modat B.V.60606 21968 55089 63983 235112.3K
85.217.149.4o005.scanner.modat.io🇨🇦CAAS209334 Modat B.V.42879 1545 48368 12437 80752.3K
85.217.149.32o033.scanner.modat.io🇨🇦CAAS209334 Modat B.V.5930 45087 43439 48012 629652.3K
85.217.149.12o013.scanner.modat.io🇨🇦CAAS209334 Modat B.V.13606 6225 63423 48660 614402.3K
85.217.140.8o308.scanner.modat.io🇫🇷FRAS209334 Modat B.V.50833 15331 4881 14740 487742.3K
85.217.149.57o057.scanner.modat.io🇨🇦CAAS209334 Modat B.V.53839 12779 336 64437 222932.2K
85.217.149.29o030.scanner.modat.io🇨🇦CAAS209334 Modat B.V.19740 23833 25599 42937 420952.2K
85.217.149.0o001.scanner.modat.io🇨🇦CAAS209334 Modat B.V.34321 6280 35706 45313 116352.1K
85.217.140.3o303.scanner.modat.io🇫🇷FRAS209334 Modat B.V.57500 62595 60198 53883 527202.1K
Showing top 50 by event count over the last 7d. Country, ASN and port cells narrow this query; any IP opens its full report scoped to it.