iAnonymous lookups: 10/min, 60/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.
Filtered actors
country=IT
72 unique IPs · 136.5K events · 1 countries · 14 ASNs
Activity · last 7d
peak 136.3K on 2026-06-30
Top source networks · click to refine
country: IT×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed
Sample payloads
top distinct probes matching this query| Protocol | Port | Probe / payload | Hits | Example |
|---|---|---|---|---|
| HTTP | 9006 | GET /api/credentials.json UA: Mozilla/5.0 (X11; FreeBSD amd64; rv:54.0) Gecko/20100101 Firefox/54.0 | 66 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /private/credentials.json UA: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080716 (Gentoo) Galeon/2.0.6 | 64 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /docker-compose.yaml UA: Mozilla/5.0 (Linux; Android 9; Redmi Note 7 Build/PKQ1.180904.001) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser… | 60 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /secrets.yml UA: facebookexternalhit/1.1 | 60 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /docker-compose.yml UA: Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.2 (KHTML, like Gecko) Ubuntu/11.10 Chromium/15.0.874.120 Chrome/15.0.874.1… | 60 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /terraform.tfvars UA: Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.8 (KHTML, like Gecko) Chrome/4.0.277.0 Safari/532.8 | 59 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /docker-compose.production.yml UA: Mozilla/5.0 (Linux; Android 9; LM-G710) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 | 59 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /Dockerfile UA: Mozilla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11; | 59 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /docker-compose.override.yml UA: Mozilla/5.0 (Linux; Android 7.1.1; SM-J510F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/5… | 59 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /helm/values.yaml UA: Mozilla/5.0 (Linux; Android 8.0.0; PRA-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/53… | 59 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /docker-compose.prod.yml UA: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a3pre) Gecko/20070330 | 58 · 28 IPs | 34.154.166.70 → |
| HTTP | 9006 | GET /secrets.yaml UA: Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 | 58 · 28 IPs | 34.154.166.70 → |
IPCountryASNTop portsEvents