HoneyLabs
iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors

port=9528

30 unique IPs · 36 events · 8 countries · 6 ASNs

Activity · last 7d

2026-06-27: 7 events2026-06-28: 7 events2026-06-29: 4 events2026-06-30: 5 events2026-07-01: 3 events2026-07-02: 4 events2026-07-03: 6 events

peak 7 on 2026-06-27

Top source networks · click to refine

Refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
HTTP9528GET /
UA: curl/7.64.1
18 · 16 IPs47.250.142.113 →
-95280a4 · 4 IPs85.217.149.15 →
HTTP9528GET /.well-known/security.txt
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
3 · 3 IPs162.216.149.226 →
HTTP9528GET /favicon.ico
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 · 2 IPs47.89.246.29 →
HTTP9528GET /squid-internal-mgr/cachemgr.cgi
UA: Mozilla/5.0 zgrab/0.x
168.183.5.101 →
-9528�����179.164.41.168 →
HTTP9528GET /actuator/jolokia/version
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
1162.216.150.108 →
HTTP9528GET /api/jolokia/list
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
135.203.211.249 →
TLS9528t3 12.1.2 AS:2048 HL:191123.58.213.118 →
HTTP9528GET /jolokia/exec
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
1147.185.132.244 →
HTTP9528GET /jolokia
UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpan…
135.203.211.153 →
HTTP9528GET /sitemap.xml
UA: Go-http-client/1.1
1118.26.39.231 →
IPCountryASNTop portsEvents
Showing top 50 by event count. Window is the last 7d. Add or remove filters by clicking any value on a per-IP report.