AS12989: Black HOST Ltd
HoneyLabs honeypots recorded 3,052 probes from AS12989 (Black HOST Ltd) in the last 7 days, originating from 8 distinct source IP addresses.
First observed 2026-11-06 04:28, most recently 2026-11-13 04:07 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-09, with 519. Its 8 addresses probed 729 distinct ports. No port took more than 2% of the probes. One address, 86.54.31.36, sent 50% of them. 7 of the 8 busiest addresses are recognised research scanners.
Ports it targets
| Port | Probes |
|---|---|
| 443 | 56 |
| 80 | 25 |
| 30009 | 20 |
| 21255 | 20 |
| 18035 | 20 |
| 14104 | 20 |
| 12413 | 20 |
| 9444 | 20 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 86.54.31.36 | 1,533 | Canada | |
| 86.54.31.44 | 1,243 | Canada | |
| 86.54.31.32 | 86 | Canada | |
| 86.54.31.38 | 71 | Canada | |
| 86.54.31.34 | 61 | Canada | |
| 86.54.31.40 | 40 | Canada | |
| 86.54.31.46 | 10 | Canada | |
| 2.59.21.51 | 8 | Italy |
Where it comes from
| Country | Probes |
|---|---|
| Canada | 3,044 |
| Italy | 8 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36 | 1,455 |
| Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36 | 1,437 |
| Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36 | 21 |
| python-requests/2.23.0 | 4 |
ASN report
ASN report
Loading