HoneyLabs
iAnonymous lookups: 10/min, 60/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.

Filtered actors

query: asn:50360

6 unique IPs · 1.2K events · 1 countries · 1 ASNs

Activity · last 7d

2026-06-14: 101 events2026-06-15: 180 events2026-06-16: 151 events2026-06-17: 143 events2026-06-18: 173 events2026-06-19: 154 events2026-06-20: 156 events2026-06-21: 103 events

peak 180 on 2026-06-15

Top source networks · click to refine

Refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed

Sample payloads

top distinct probes matching this query
ProtocolPortProbe / payloadHitsExample
RDP36604-(�Cookie: mstshash=msrdp60 1.0K79.124.59.78 →
HTTP80/HTTPGET /?XDEBUG_SESSION_START=phpstorm
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1079.124.40.174 →
HTTP80/HTTPGET /actuator/gateway/routes
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
979.124.40.174 →
-5432/Postgres00 00 00 65 00 03 00 00 65 78 74 72 61 5f 66 6c 6f 61 74 5f 64 69 67 69 …(256 bytes)979.124.40.174 →
HTTP2083GET /
UA: Python/3.10 aiohttp/3.14.1
879.124.60.168 →
-3000/Web-alt02 01 00 00 00 00 00 06 62 75 69 6c 64 0a679.124.40.174 →
HTTP8081GET /jars
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
679.124.40.174 →
HTTP8040GET /SetupWizard.aspx/grurfNbmcY
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
379.124.40.186 →
HTTP443/HTTPSGET /php/login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
379.124.40.190 →
HTTP8040GET /SetupWizard.aspx/ztldDKdoSO
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.2 Safari/605.1.15
379.124.40.190 →
-9000/Web-alt� SCRIPT_NAME/usr/share/php/PEAR.php REMOTE_ADDR127.0.0.1CONTENT_LENGTH52SERVER_PROTOCOLHTTP/1.1 DOCUMENT_ROOT/SERVER_SOFTWAREphp/fcgiclient SERVER…179.124.40.174 →
-9001/Tor�REQUEST_METHODPOST QUERY_STRING REMOTE_PORT9985 SERVER_NAMElocalhost 4PHP_VALUEauto_prepend_file = php://input disable_functions =  GATEWAY_INTERFACEF…179.124.40.174 →
IPCountryASNTop portsEvents
Showing top 50 by event count. Window is the last 7d. Add or remove filters by clicking any value on a per-IP report.