HoneyLabs

https://honeylabs.net/docs
Admin
HoneyLabs operates public internet honeypots to log and analyze scanner traffic, providing threat...
Tokens:5,595
Snippets:49
Trust Score:6.4
Update:4 weeks ago
Show doc for...
Tokens:
Raw
### CSV export examples for leaderboard, per-IP, per-CVE, and ports endpoints

Source: https://honeylabs.net/docs

Use ?format=csv on these endpoints to get a downloadable spreadsheet. The JSON path is canonical; CSV is for one-off analysis.

```bash
curl 'https://honeylabs.net/lookup/<ip>?format=csv'
curl 'https://honeylabs.net/api/cves/<id>?format=csv'
curl 'https://honeylabs.net/api/ports?format=csv'
```

--------------------------------

### Example JSON response for IP lookup

Source: https://honeylabs.net/docs

Trimmed example response from an IP lookup. The sample IP is from RFC 5737 (documentation use); a real request returns the IP you asked for. Shows fields like country, ASN, totals, ports, fingerprints, CVEs, and recent events.

```json
{
  "ip": "203.0.113.5",
  "country": "NL",
  "asn": 202425,
  "rdns": "scanner.example",
  "totals": { "events": 481223, "events_24h": 1842, "days_active": 87 },
  "ports": [{ "port": 22, "count": 124091 }, { "port": 445, "count": 88210 }],
  "fingerprints": {
    "tls":  [{ "ja4":  "t13d1516h2_8daaf6152771_b1ff8ab2d16f", "count": 12 }],
    "ssh":  [{ "hassh": "06046bafe3a5...", "count": 8 }]
  },
  "cves": [{ "id": "CVE-2024-4577", "count": 12 }],
  "recent_events": [{ "timestamp": "...", "dest_port": 445, "...": "..." }]
}
```

--------------------------------

### IOC feed URL formats and fail2ban/Pi-hole cron example

Source: https://honeylabs.net/docs

Feed URLs return different content types based on extension: text/plain (one IP per line), CSV (ip,first_seen,last_seen,events,asn,country), or JSON (array of full event records). The cron example shows pulling the text/plain feed into a blocklist file every 5 minutes.

```bash
curl 'https://honeylabs.net/feed/<token>'        # text/plain, one IP per line (firewall-ready)
curl 'https://honeylabs.net/feed/<token>.csv'    # ip,first_seen,last_seen,events,asn,country
curl 'https://honeylabs.net/feed/<token>.json'   # array of full event records

# Wire into fail2ban / Pi-hole / Cisco / any blocklist consumer:
*/5 * * * *  curl -fsS 'https://honeylabs.net/feed/<token>' > /etc/blocklist.txt
```

--------------------------------

### curl: MCP JSON-RPC 2.0 tools/list request

Source: https://honeylabs.net/docs

Call the MCP endpoint directly from your own code using JSON-RPC 2.0 over HTTP. This example lists available tools.

```bash
curl -X POST https://mcp.honeylabs.net/mcp \
  -H "Authorization: Bearer hlk_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

--------------------------------

### MCP connector URL for Claude.ai/Desktop

Source: https://honeylabs.net/docs

Paste this URL into Settings > Connectors > Add custom connector in Claude.ai or Claude Desktop. No API key is involved.

```text
https://mcp.honeylabs.net/mcp
```

--------------------------------

### curl with a key: Authenticated lookup request

Source: https://honeylabs.net/docs

Pass your API key as a bearer token. The key provides your plan's daily credit budget and time-range window. One credit equals one row of data returned (minimum one per call).

```bash
curl https://honeylabs.net/lookup?asn=14061&since=30d&format=json \
  -H "Authorization: Bearer hlk_xxxxxxxxxxxxxxxx"
```

--------------------------------

### JSON lookup with format=json

Source: https://honeylabs.net/docs

Any lookup URL accepts ?format=json to return JSON. Alternatively, sending Accept: application/json or using curl's default User-Agent also yields JSON. Replace <ip> with the target IP.

```bash
curl https://honeylabs.net/lookup/<ip>?format=json
```

--------------------------------

### curl: Public showcase endpoints (unauth)

Source: https://honeylabs.net/docs

Public showcase data (top countries, top ports, top ASNs) is available without authentication at /api/showcase and /api/stats.

```bash
curl https://honeylabs.net/api/showcase
```

--------------------------------

### claude mcp add: Configure CLI client with key

Source: https://honeylabs.net/docs

For Claude Code and other CLI clients, add the HoneyLabs MCP server using a key from your dashboard.

```bash
claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer hlk_xxxxxxxxxxxxxxxx"
```

--------------------------------

### curl: Leaderboard API endpoints (JSON and CSV)

Source: https://honeylabs.net/docs

Access leaderboards in JSON or CSV format. CVE windows accept 1h, 24h, or 7d; 30d is unsupported. CSV exports are supported on every leaderboard and per-IP/per-CVE detail pages via ?format=csv.

```bash
curl https://honeylabs.net/api/cves?window=7d
curl https://honeylabs.net/api/cves?window=7d&format=csv
curl https://honeylabs.net/api/cves/CVE-2024-4577
curl https://honeylabs.net/api/asn/14061
curl https://honeylabs.net/api/ports?limit=50
curl https://honeylabs.net/api/port/22
curl https://honeylabs.net/api/user-agents?limit=50
```

--------------------------------

### Side-by-side IP compare URL

Source: https://honeylabs.net/docs

Constructs a URL for the /compare endpoint, which accepts up to 4 IPs and displays ASN, country, total events, port profile, and CVE matches. Useful for investigating if two addresses run the same scanner from different rentals.

```http
https://honeylabs.net/compare?ips=1.2.3.4,5.6.7.8
```

--------------------------------

### TAXII 2.0 Discovery and Collection Access

Source: https://honeylabs.net/docs

These curl commands demonstrate the TAXII 2.0 API: discovery, listing collections, fetching objects, and incremental polling. The discovery endpoint is open, but object access requires an API key as the HTTP Basic password (username ignored). The added_after parameter enables incremental polling.

```bash
# Discovery (open)
curl 'https://honeylabs.net/taxii2/'

# Collections: exploiters and malware-infrastructure
#   253ff00b-4863-571f-8949-9d05616de5b7   exploiters
#   e144c129-a19a-55c8-b926-dd2dfbbd8138   malware-infrastructure

# Objects need an API key as the HTTP Basic password (username is ignored)
curl -u 'taxii:<your API key>' \
  'https://honeylabs.net/taxii2/api/collections/exploiters/objects/?limit=100'

# Incremental polling via added_after
curl -u 'taxii:<your API key>' \
  'https://honeylabs.net/taxii2/api/collections/exploiters/objects/?added_after=2026-07-15T00:00:00Z'
```
Tokens:
Raw