honeylabs
1,001 IPs, 64 countries, one operation: mapping a botnet by its back end
An analysis of how internet scanners are targeting AI infrastructure
Re:Show HN: HoneyLabs – Public honeypot threat Intel feed and MCP server
on Monday May 18, 2026 @12:30PM (#48181957)
Absolutely. I started with IPv4 because it sees significantly more scan traffic, but expanding to IPv6 is on the roadmap. Once I update the underlying honeypots to capture IPv6 traffic, those lookups will automatically populate on the main site.
Show HN: HoneyLabs – Public honeypot threat Intel feed and MCP server
I've been running a small fleet of honeypots for about a year. They get hit by a mix of research scanners (Censys, Shadowserver, etc.), old worms, and a bump of CVE probes the day a new Nuclei template ships. The data was sitting in a database and useful only to me, so I put a front end on it.https://honeylabs.netPaste a public IPv4 and you get its 90-day report: ASN, country, what ports it...