top_attackers

MCP tool from Honeylabs MCP by honeylabshq

Ranked leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve') over a time window.

How to use it

Project documentation lists top_attackers for the Honeylabs MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

FULL HONEYLABS MCP LISTING

Other tools in Honeylabs MCP (7)

asn_enrich

Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name.

attack_timeline

Hourly / daily attack volume over a window, with protocol / country / port filters.

cve_lookup

Who is probing a named CVE: severity, KEV status, top probing IPs with ASN and scanner tag, fingerprints, sample paths, daily timeline.

fingerprint_search

Search by TLS JA4 / JA3 / HTTP JA4H / SSH HASSH fingerprint to find shared infrastructure.

ioc_lookup

Is this IP / domain known to be probing? Returns our verdict, whether it is a recognised benign scanner, the CVEs it probed, plus ports / paths / fingerprints.

payload_search

Full-text URL-path + user-agent search across attack traffic.

search_events

Raw honeypot events matching filters (IP, ASN, country, destport, protocol, httpmethod, ja4/ja3, communityid, hasclientcert).