iAnonymous lookups: 10/min, 60/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.
Filtered actors
query: port:20000
226 unique IPs · 1.6K events · 19 countries · 33 ASNs
Activity · last 7d
peak 790 on 2026-06-15
Top source networks · click to refine
query: port:20000×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed
Sample payloads
top distinct probes matching this query| Protocol | Port | Probe / payload | Hits | Example |
|---|---|---|---|---|
| HTTP | 20000 | GET / | 167 · 113 IPs | 60.16.222.113 → |
| HTTP | 20000 | GET /favicon.ico UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 | 113 · 68 IPs | 118.212.123.59 → |
| - | 20000 | d� 6Ld� ގd� ��d� wFd� �d� �Rd� �Xd� \�d� �d� �{d� �qd� X�d� 2ed� ڧd� ��d� sod� �d� �)d… | 50 · 48 IPs | 66.132.195.77 → |
| TLS | 20000 | 50 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a 0d 0a 53 4d 0d 0a 0d 0a …(57 bytes) | 20 · 20 IPs | 167.94.146.58 → |
| - | 20000 | 0d 0a 0d 0a | 13 · 7 IPs | 188.166.164.91 → |
| HTTP | 20000 | GET /sitemap.xml UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Ed… | 12 · 12 IPs | 107.150.117.219 → |
| - | 20000 | HELP | 12 · 6 IPs | 188.166.164.91 → |
| - | 20000 | 00 1e 00 06 01 00 00 01 00 00 00 00 00 00 07 76 65 72 73 69 6f 6e 04 62 …(32 bytes) | 12 · 6 IPs | 188.166.164.91 → |
| RDP | 20000 | /*� Cookie: mstshash=Administr | 11 · 3 IPs | 192.253.248.180 → |
| TPKT | 20000 | TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 02 00 00 00 | 11 · 4 IPs | 160.119.76.34 → |
| TLS | 20000 | d D |���� O� | 10 · 10 IPs | 91.231.89.219 → |
| - | 20000 | JRMI K | 10 · 10 IPs | 107.150.117.219 → |
IPCountryASNTop portsEvents