AS16276: OVH SAS
HoneyLabs honeypots recorded 645,277 probes from AS16276 (OVH SAS) in the last 7 days, originating from 38 distinct source IP addresses.
First observed 2026-11-07 19:52, most recently 2026-11-14 19:51 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-13, with 268,569. Its 38 addresses probed 79 distinct ports. The most probed was port 4577, with 100% of the probes. One address, 148.113.45.117, sent 100% of them. None of the 25 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 4577 | 644,852 |
| 3000 | 57 |
| 20081 | 52 |
| 5038 | 38 |
| 443 | 27 |
| 1433 | 22 |
| 445 | 14 |
| 8443 | 13 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 148.113.45.117 | 644,852 | India | |
| 184.174.96.19 | 69 | United States | |
| 149.56.31.99 | 52 | Canada | |
| 15.204.101.211 | 47 | United States | |
| 5.135.108.213 | 38 | France | |
| 15.235.81.212 | 32 | Canada | |
| 146.59.197.49 | 27 | France | |
| 135.148.138.152 | 27 | United States |
Where it comes from
| Country | Probes |
|---|---|
| India | 644,852 |
| United States | 143 |
| France | 126 |
| Canada | 96 |
| Germany | 34 |
| United Kingdom | 16 |
Client strings it sends
| User agent | Probes |
|---|---|
| kx | 69 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 44 |
| Mozilla/5.0 | 32 |
| Go-http-client/1.1 | 26 |
| Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0 | 12 |
ASN report
ASN report
Loading