iAnonymous lookups: 10/min, 60/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.
Filtered actors
query: port:2000
23 unique IPs · 66 events · 8 countries · 11 ASNs
Activity · last 24h
peak 41 on 2026-07-01
Top source networks · click to refine
query: port:2000×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed
Sample payloads
top distinct probes matching this query| Protocol | Port | Probe / payload | Hits | Example |
|---|---|---|---|---|
| HTTP | 2000 | GET / UA: curl/7.64.1 | 24 · 11 IPs | 47.251.69.170 → |
| HTTP | 2000 | GET /favicon.ico UA: fasthttp | 6 · 4 IPs | 43.98.184.9 → |
| - | 2000 | 3 · 3 IPs | 216.218.206.68 → | |
| - | 2000 | 0a | 3 | 18.116.101.220 → |
| - | 2000 | 38 00 00 00 00 00 00 00 01 00 00 00 53 45 50 30 30 30 39 34 33 36 36 35 …(64 bytes) | 3 · 3 IPs | 198.235.24.81 → |
| - | 2000 | MGLNDD_<HONEYPOT>_2000 | 3 · 3 IPs | 20.118.32.171 → |
| HTTP | 2000 | POST /api/route UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 | 2 · 2 IPs | 160.119.71.136 → |
| - | 2000 | 44 6d 64 54 00 00 00 17 00 00 00 01 00 00 00 00 11 11 00 ff 01 ff 13 | 2 · 2 IPs | 47.251.69.170 → |
| HTTP | 2000 | POST /_next/server UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. | 2 · 2 IPs | 160.119.71.136 → |
| - | 2000 | 0d 0a | 2 · 2 IPs | 47.251.69.170 → |
| HTTP | 2000 | POST /app UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 | 2 · 2 IPs | 160.119.71.136 → |
| HTTP | 2000 | POST /_next UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 | 2 · 2 IPs | 160.119.71.136 → |
IPCountryASNTop portsEvents