… events in the last 24 hours

HoneyLabs,
queryable by your AI.

The same 13M+ events behind honeylabs.net, exposed as MCP tools. Query attacker fingerprints, targeted ports, and CVE matches from Claude, Cursor, or any MCP client.

500 credits/day, 7-day lookback, no credit card.

Connect in 30 seconds

Streamable HTTP

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer hlk_..."

Settings → MCP, or edit .cursor/mcp.json:

{
  "mcpServers": {
    "honeylabs": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": { "Authorization": "Bearer hlk_..." }
    }
  }
}

Edit claude_desktop_config.json:

{
  "mcpServers": {
    "honeylabs": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": { "Authorization": "Bearer hlk_..." }
    }
  }
}

Edit ~/.continue/config.json:

{
  "mcpServers": [{
    "name": "honeylabs",
    "transport": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp",
      "requestOptions": {
        "headers": { "Authorization": "Bearer hlk_..." }
      }
    }
  }]
}

Any MCP client that supports Streamable HTTP:

URL:     https://mcp.honeylabs.net/mcp
Header:  Authorization: Bearer hlk_...
Transport: Streamable HTTP / SSE

Tested with Claude (Code, Desktop), Cursor, Windsurf, Continue, Zed.

Need a key? for a magic link.

Free, no API key

IP threat reports

Instant browser profile for any public IPv4. Timeline, targeted ports, TLS/SSH fingerprints, CVE matches.

honeylabs.net/lookup · curl returns JSON

Last 24 hours

Top sources, last 24 hours

Same view your AI gets when it calls top_attackers. Cached for 5 minutes.

Origin

Top countries

top_attackers(by=country)

🇺🇸United States99.6K
🇳🇱The Netherlands37.6K
🇬🇧United Kingdom14.0K
🇨🇦Canada13.6K
🇦🇷Argentina8.7K

Networks

Top ASNs

top_attackers(by=asn)

AS396982Google LLC54.3K
AS6206Netrouting B.V.28.3K
AS399296Rackdog, LLC21.9K
AS209334Modat B.V.13.5K
AS135377UCLOUD INFORMATION TEC11.3K

Targets

Top ports hit

top_attackers(by=port)

79287 IPs
39131324 IPs
445SMB258 IPs
80HTTP220 IPs
443HTTPS199 IPs

Infra

Top scanner hostnames

top_attackers(by=domain)

🇺🇸185.99.70.136.bc.googleusercon9.2K
🇳🇱rnd.group-ib.com5.1K
🇺🇸163.254.145.34.bc.googleuserco3.3K
🇺🇸scan.visionheight.com3.1K
🇺🇸internettl.org1.4K

To reproduce the last column from an MCP client: top_attackers(by="domain", since="2026-05-13", until="2026-05-14")

Example conversation

The AI calls the MCP tools, gets back rows, summarises the answer.

You

Who's hammering SSH on the internet this week? Any unusual clients?

→ top_attackers(by="asn", dest_port=22, since="2026-05-06", until="2026-05-13")

→ fingerprint_search(fp_type="hassh", fingerprint="5bd26477da54…")

Top SSH-scanning ASN this week is AS47890 (Unmanaged Ltd) with 6,163 hits to port 22. AS48090 (Techoff Srv Limited, NL) is #2, mostly from the cluster 45.148.10.141-152.

One HASSH stands out: 5bd26477da54… - 8,885 events from just 21 unique IPs across RO, NL, PA and US. Tight infra footprint, port 22 only - looks like one coordinated brute-force operation. Want the IP list?

Sensor IPs are redacted from every response.

Common uses

SOC & IR

Enrich alerts in seconds

Drop an IP, JA4 or HASSH into your assistant and get sighting history, targeted ports, and ASN context without leaving chat.

Threat hunting

Track campaigns over time

Slice events by ASN, country, port, or fingerprint. Spot when a campaign starts, shifts targets, or burns its infrastructure.

Research

Test a hypothesis fast

3.7M JA4 TLS, 3.2M JA4H HTTP, 26K HASSH SSH fingerprints. Ask the AI to correlate and summarise, no SQL needed.

7 threat-intel tools

Sensor names and honeypot IPs are redacted from every response.

search_events free ›

Raw events filtered by IP, country, ASN, port, or HTTP method. Returns timestamps, JA4/JA4H/HASSH fingerprints, user-agent and event summary.

search_events(country="CN", dest_port=22, limit=10)
→ [{ timestamp, source_ip, ssh_client_hassh, event_summary, … }]

top_attackers free ›

Leaderboard grouped by IP, ASN, country, port, user-agent, JA4 fingerprint, or URL path. Includes first/last seen and target diversity.

top_attackers(by="asn", since="2026-05-06", until="2026-05-13")
→ [{ value: 14061, event_count: 121519, asn_org: "DigitalOcean, LLC", … }]

ioc_lookup free ›

Given an IP or domain: sighting count, first/last seen, targeted ports, ASN, top user-agents, JA4 and HASSH fingerprints.

ioc_lookup("<ip-or-domain>")
→ { total_events: 272780, asn_org: "IP Volume inc", country_code: "NL",
    ports_targeted: [22,23,80,443,3389,…], top_user_agents: [...] }

attack_timeline free ›

Hourly or daily event counts. Optional filters for protocol, country, dest_port. Useful for spotting campaign starts and traffic spikes.

attack_timeline(bucket="day", filter_dest_port=445)
→ [{ bucket: "2026-05-12", event_count: 9870, unique_sources: 419 }, …]

asn_enrich free ›

Full honeypot profile for an ASN: top IPs, ports, protocols, source countries. Attribute campaigns to hosting providers.

asn_enrich("AS202425", since=…, until=…)
→ { org_name: "IP Volume inc", total_events: 32597, unique_ips: 55,
    top_ports: [7777, 2715, 1723, 3128, 25], top_source_ips: [...] }

fingerprint_search free ›

Find all activity matching a JA4 TLS, JA4H HTTP, or HASSH SSH fingerprint. 3.7M / 3.2M / 26K fingerprints in the dataset.

fingerprint_search(fp_type="ja4", fingerprint="t13i190800_…")
→ { total_events, top_source_ips, source_asns, samples: [...] }

payload_search pro ›

Full-text search across masked HTTP bodies, headers, and URL paths. Hunt who probed a specific path or sent a specific payload.

payload_search(query="/.git/config", since=…, until=…)
→ [{ source_ip, url_path, event_summary, … }]

HoneyLabs, queryable by your AI.