AS12389: Rostelecom
HoneyLabs honeypots recorded 948 probes from AS12389 (Rostelecom) in the last 7 days, originating from 83 distinct source IP addresses.
First observed 2026-11-07 20:53, most recently 2026-11-14 18:55 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-12, with 220. Its 83 addresses probed 8 distinct ports. The most probed was port 445, with 76% of the probes. No single address sent more than 13% of them. None of the 25 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 445 | 725 |
| 22 | 93 |
| 1080 | 88 |
| 3128 | 24 |
| 7890 | 8 |
| 1433 | 6 |
| 139 | 2 |
| 8000 | 2 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 90.151.171.108 | 120 | Russia | |
| 77.40.51.90 | 90 | Russia | |
| 89.109.59.242 | 24 | Russia | |
| 82.208.70.243 | 24 | Russia | |
| 87.103.212.16 | 24 | Russia | |
| 92.126.240.238 | 24 | Russia | |
| 78.36.101.251 | 16 | Russia | |
| 188.17.153.162 | 16 | Russia |
Where it comes from
| Country | Probes |
|---|---|
| Russia | 948 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https://best-proxies.ru/faq/#from) | 30 |
| Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https://best-proxies.ru/faq/#from) Z74342541223Q1 | 14 |
| Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https://best-proxies.ru/faq/#from) Z71506402930Q1 | 12 |
| Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https://best-proxies.ru/faq/#from) Z70681045900Q1 | 4 |
ASN report
ASN report
Loading