HoneyLabs

See what is scanning the internet, down to the payload.

We run open-source honeypot sensors on the public internet. Each scan they capture is searchable here with its TLS, HTTP, and SSH fingerprints and the raw probe payload, 90 days back, free. Look up any IP, or wire the same data into your own tooling over MCP and HTTP.

Browse CVEs

$ curl honeylabs.net/lookup/<ip> returns JSON. for MCP and JSON-RPC.

CVEs in the wild: a live tracker of what is actually being exploited, with pre-disclosure detection.

One lookup, the whole picture

A live report for a single IP. Verdict, evidence, and every entity is a thread to pull.

Open the full report

Recognized scanner, high confidence

80.82.77.202
AS202425 IP Volume inc·The Netherlands·Group-IB (commercial)
310.3K
events
111
distinct ports
Feb 16
first seen
Jul 2
last seen
Ports it swept
78955000Web-alt6379Redis129392011194OpenVPN
TLS fingerprint
t13i191000_9dc949149365_be53661681a4

Pivot to

AS202425port:7895JA4 clustercountry:NL

Related

JA4 cluster2
Ports swept111
Rotating UAs7

Bring it into your stack

Same data and the same auth over curl, MCP and JSON-RPC, or through the tool you already run.

All integrations

Browser or curl

GET /lookup/<ip>

Any public IPv4, no account. Paste it in a browser for the full report, or fetch the same URL from a script: you get JSON for curl / wget / an explicit Accept header, or append ?format=json.

https://honeylabs.net/lookup/<ip>
curl https://honeylabs.net/lookup/<ip>
curl -H "Accept: application/json" https://honeylabs.net/lookup/<ip>

Rate limited to 60 different lookups an hour per source IP. No account.

From Claude, Cursor, or anything

POST /mcp

Streamable HTTP transport. Eight tools covering attacker enrichment, fingerprint search, payload search, and time-series.

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer <key>"

Free tier: 500 credits/day. Pro: 50k/day with 90-day history. 1 credit = 1 row of data returned. Get a key from the dashboard.

Direct API for your own code

POST /mcp

Skip the MCP client. POST a JSON-RPC envelope, get an SSE response back. Same bearer auth as the MCP tab.

curl -X POST https://mcp.honeylabs.net/mcp \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Use tools/list to enumerate, tools/call to invoke. Standard MCP wire format.

Explore the live dataset

What is hitting the sensors right now. Click any row to open a filtered view.

Browse all
Top ports24h
loading…
Top source networks24h
loading…
Top HTTP fingerprintsJA4H · 24h
loading…

Emerging campaigns

One fingerprint carried by many IPs across only a few networks usually means a coordinated operation.

See all
…
loading…
loading…
loading…