iAnonymous lookups: 30/hr per source IP. Sign in (free) to lift the limit, run heavier queries, and get an API key for MCP / HTTP.
Filtered actors · live query
1.7K unique IPs · 235.6K events · 49 countries · 148 ASNs
Activity · last 7d
peak 95.8K on 2026-08-04
Top source networks · click to refine
query: proto:rdp×window1h24h7d30d🔒90d🔒
Turn this query into a daily email digest or an IOC feed URL.Save as feed
Sample payloads
top distinct probes matching this query| Protocol | Port | Probe / payload | Hits | Example |
|---|---|---|---|---|
| RDP | 3393 | TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 03 00 00 00 | 120.3K · 148 IPs | 107.155.88.70 → |
| RDP | 44119 | /*� Cookie: mstshash=Administr | 64.4K · 28 IPs | 62.164.177.54 → |
| RDP | 3389/RDP | +&� Cookie: mstshash=hello | 26.9K · 38 IPs | 5.180.252.158 → |
| RDP | 49663 | +&� Cookie: mstshash=hello | 14.3K · 4 IPs | 149.50.110.48 → |
| RDP | 2443 | TPKT / COTP (ISO-TSAP)03 00 00 0b 06 e0 00 00 00 00 00 | 1.5K · 795 IPs | 128.14.237.130 → |
| RDP | 3389/RDP | RDP (X.224)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 00 00 00 00 | 1.2K · 209 IPs | 44.220.188.32 → |
| RDP | 38472 | -(� Cookie: mstshash=msrdp60 | 1.1K | 79.124.59.78 → |
| RDP | 80/HTTP | *%� Cookie: mstshash=beio | 867 · 532 IPs | 206.81.17.138 → |
| RDP | 82 | TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 02 00 00 00 | 805 · 218 IPs | 91.196.225.242 → |
| RDP | 3338 | ,'� Cookie: mstshash=Administrator | 760 · 497 IPs | 173.255.192.244 → |
| RDP | 2443 | 3.� Cookie: mstshash=Administrator | 503 · 209 IPs | 128.14.237.130 → |
| RDP | 3338 | TPKT / COTP (ISO-TSAP)03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 01 00 00 00 | 253 · 213 IPs | 157.245.167.36 → |
IPCountryASNTop portsEvents