iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.
Filtered actors
query: ja4:t13i191000_9dc949149365_e5728521abd4
43 unique IPs · 1.9K events · 10 countries · 16 ASNs
Activity · last 7d
peak 631 on 2026-06-30
Top source networks · click to refine
Turn this query into a daily email digest or an IOC feed URL.Save as feed
Sample payloads
top distinct probes matching this query| Protocol | Port | Probe / payload | Hits | Example |
|---|---|---|---|---|
| HTTP | 2443 | GET / UA: Go-http-client/1.1 | 373 · 35 IPs | 31.57.184.226 → |
| HTTP | 5000/Web-alt | POST / UA: Go-http-client/1.1 | 110 · 35 IPs | 46.101.167.209 → |
| HTTP | 8080/HTTP-alt | GET /.env.save UA: l9explore/1.2.2 | 33 · 2 IPs | 45.148.10.200 → |
| HTTP | 443/HTTPS | GET /.env UA: l9explore/1.2.2 | 31 · 2 IPs | 45.148.10.200 → |
| HTTP | 80/HTTP | GET /.git/config UA: l9explore/1.2.2 | 30 · 2 IPs | 45.148.10.200 → |
| HTTP | 9090/Prometheus | GET /.env.example UA: l9explore/1.2.2 | 29 · 2 IPs | 80.87.206.229 → |
| HTTP | 8080/HTTP-alt | GET /.env.old UA: l9explore/1.2.2 | 29 · 2 IPs | 45.148.10.200 → |
| HTTP | 80/HTTP | GET /.dotenv UA: l9explore/1.2.2 | 28 | 45.148.10.200 → |
| HTTP | 9090/Prometheus | GET /.env.backup UA: l9explore/1.2.2 | 28 · 2 IPs | 80.87.206.229 → |
| HTTP | 80/HTTP | GET /.env.local UA: l9explore/1.2.2 | 27 · 2 IPs | 45.148.10.200 → |
| HTTP | 443/HTTPS | GET /storage/.env UA: l9explore/1.2.2 | 27 | 45.148.10.200 → |
| HTTP | 80/HTTP | GET /.envrc.local UA: l9explore/1.2.2 | 26 | 45.148.10.200 → |
IPCountryASNTop portsEvents
161.35.211.5🇩🇪DEAS14061 DigitalOcean, LLC5000/Web-alt 6443/k8s API 8080/HTTP-alt 8086/InfluxDB 445/SMB12
165.232.76.203🇩🇪DEAS14061 DigitalOcean, LLC6443/k8s API 9042/Cassandra 5060/SIP 8086/InfluxDB 2000011
157.230.107.97rmp-mongo-beta-log-3a8b0339.mongo.ondigitalocean.com🇩🇪DEAS14061 DigitalOcean, LLC631/IPP 5000/Web-alt 22/SSH 8086/InfluxDB 200009