### CSV export examples for leaderboard, per-IP, per-CVE, and ports endpoints Source: https://honeylabs.net/docs Use ?format=csv on these endpoints to get a downloadable spreadsheet. The JSON path is canonical; CSV is for one-off analysis. ```bash curl 'https://honeylabs.net/lookup/?format=csv' curl 'https://honeylabs.net/api/cves/?format=csv' curl 'https://honeylabs.net/api/ports?format=csv' ``` -------------------------------- ### Example JSON response for IP lookup Source: https://honeylabs.net/docs Trimmed example response from an IP lookup. The sample IP is from RFC 5737 (documentation use); a real request returns the IP you asked for. Shows fields like country, ASN, totals, ports, fingerprints, CVEs, and recent events. ```json { "ip": "203.0.113.5", "country": "NL", "asn": 202425, "rdns": "scanner.example", "totals": { "events": 481223, "events_24h": 1842, "days_active": 87 }, "ports": [{ "port": 22, "count": 124091 }, { "port": 445, "count": 88210 }], "fingerprints": { "tls": [{ "ja4": "t13d1516h2_8daaf6152771_b1ff8ab2d16f", "count": 12 }], "ssh": [{ "hassh": "06046bafe3a5...", "count": 8 }] }, "cves": [{ "id": "CVE-2024-4577", "count": 12 }], "recent_events": [{ "timestamp": "...", "dest_port": 445, "...": "..." }] } ``` -------------------------------- ### IOC feed URL formats and fail2ban/Pi-hole cron example Source: https://honeylabs.net/docs Feed URLs return different content types based on extension: text/plain (one IP per line), CSV (ip,first_seen,last_seen,events,asn,country), or JSON (array of full event records). The cron example shows pulling the text/plain feed into a blocklist file every 5 minutes. ```bash curl 'https://honeylabs.net/feed/' # text/plain, one IP per line (firewall-ready) curl 'https://honeylabs.net/feed/.csv' # ip,first_seen,last_seen,events,asn,country curl 'https://honeylabs.net/feed/.json' # array of full event records # Wire into fail2ban / Pi-hole / Cisco / any blocklist consumer: */5 * * * * curl -fsS 'https://honeylabs.net/feed/' > /etc/blocklist.txt ``` -------------------------------- ### curl: MCP JSON-RPC 2.0 tools/list request Source: https://honeylabs.net/docs Call the MCP endpoint directly from your own code using JSON-RPC 2.0 over HTTP. This example lists available tools. ```bash curl -X POST https://mcp.honeylabs.net/mcp \ -H "Authorization: Bearer hlk_xxxxxxxxxxxxxxxx" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' ``` -------------------------------- ### MCP connector URL for Claude.ai/Desktop Source: https://honeylabs.net/docs Paste this URL into Settings > Connectors > Add custom connector in Claude.ai or Claude Desktop. No API key is involved. ```text https://mcp.honeylabs.net/mcp ``` -------------------------------- ### curl with a key: Authenticated lookup request Source: https://honeylabs.net/docs Pass your API key as a bearer token. The key provides your plan's daily credit budget and time-range window. One credit equals one row of data returned (minimum one per call). ```bash curl https://honeylabs.net/lookup?asn=14061&since=30d&format=json \ -H "Authorization: Bearer hlk_xxxxxxxxxxxxxxxx" ``` -------------------------------- ### JSON lookup with format=json Source: https://honeylabs.net/docs Any lookup URL accepts ?format=json to return JSON. Alternatively, sending Accept: application/json or using curl's default User-Agent also yields JSON. Replace with the target IP. ```bash curl https://honeylabs.net/lookup/?format=json ``` -------------------------------- ### curl: Public showcase endpoints (unauth) Source: https://honeylabs.net/docs Public showcase data (top countries, top ports, top ASNs) is available without authentication at /api/showcase and /api/stats. ```bash curl https://honeylabs.net/api/showcase ``` -------------------------------- ### claude mcp add: Configure CLI client with key Source: https://honeylabs.net/docs For Claude Code and other CLI clients, add the HoneyLabs MCP server using a key from your dashboard. ```bash claude mcp add honeylabs \ --transport http \ https://mcp.honeylabs.net/mcp \ --header "Authorization: Bearer hlk_xxxxxxxxxxxxxxxx" ``` -------------------------------- ### curl: Leaderboard API endpoints (JSON and CSV) Source: https://honeylabs.net/docs Access leaderboards in JSON or CSV format. CVE windows accept 1h, 24h, or 7d; 30d is unsupported. CSV exports are supported on every leaderboard and per-IP/per-CVE detail pages via ?format=csv. ```bash curl https://honeylabs.net/api/cves?window=7d curl https://honeylabs.net/api/cves?window=7d&format=csv curl https://honeylabs.net/api/cves/CVE-2024-4577 curl https://honeylabs.net/api/asn/14061 curl https://honeylabs.net/api/ports?limit=50 curl https://honeylabs.net/api/port/22 curl https://honeylabs.net/api/user-agents?limit=50 ``` -------------------------------- ### Side-by-side IP compare URL Source: https://honeylabs.net/docs Constructs a URL for the /compare endpoint, which accepts up to 4 IPs and displays ASN, country, total events, port profile, and CVE matches. Useful for investigating if two addresses run the same scanner from different rentals. ```http https://honeylabs.net/compare?ips=1.2.3.4,5.6.7.8 ``` -------------------------------- ### TAXII 2.0 Discovery and Collection Access Source: https://honeylabs.net/docs These curl commands demonstrate the TAXII 2.0 API: discovery, listing collections, fetching objects, and incremental polling. The discovery endpoint is open, but object access requires an API key as the HTTP Basic password (username ignored). The added_after parameter enables incremental polling. ```bash # Discovery (open) curl 'https://honeylabs.net/taxii2/' # Collections: exploiters and malware-infrastructure # 253ff00b-4863-571f-8949-9d05616de5b7 exploiters # e144c129-a19a-55c8-b926-dd2dfbbd8138 malware-infrastructure # Objects need an API key as the HTTP Basic password (username is ignored) curl -u 'taxii:' \ 'https://honeylabs.net/taxii2/api/collections/exploiters/objects/?limit=100' # Incremental polling via added_after curl -u 'taxii:' \ 'https://honeylabs.net/taxii2/api/collections/exploiters/objects/?added_after=2026-07-15T00:00:00Z' ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.