HoneyLabs

The scanners spoofing AI crawler user-agents to hunt credentials turned out to be one HTTP client running on 26 addresses. On 25 August it switched from nine fixed strings to a generator that has produced 6,648 different spellings of Claude-User alone, wh

In late June, 38 Google Cloud machines fired 1.87 million requests guessing the filenames of leaked database dumps. By IP and HTTP fingerprint they looked like 11,000 unrelated scanners; by TLS fingerprint they were a single operation. A field lesson in a

Nobody's exploiting you. They're reading your .git/config.

Almost every IP we logged exploiting the Gravity SMTP credential bug shares one HTTP fingerprint. Behind it is a Google Cloud fleet of thousands of short-lived instances, disguised by 3,299 rotating user-agents, sweeping more than 36,000 ports for .env fi

Added header search to the lookup tool. One query over the forwarding headers turns up a localhost-bypass farm hunting .env files, Log4Shell still smuggled into X-Forwarded-For, and scanners leaking their own internal IPs.