AS17621: China Unicom Shanghai network
HoneyLabs honeypots recorded 493 probes from AS17621 (China Unicom Shanghai network) in the last 7 days, originating from 17 distinct source IP addresses.
First observed 2026-10-28 10:26, most recently 2026-11-04 08:51 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-10-31, with 460. Its 17 addresses probed 17 distinct ports. The most probed was port 22, with 93% of the probes. One address, 106.75.224.165, sent 92% of them. None of the 17 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 22 | 457 |
| 80 | 19 |
| 6379 | 2 |
| 41293 | 2 |
| 53 | 1 |
| 1002 | 1 |
| 1975 | 1 |
| 2120 | 1 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 106.75.224.165 | 456 | China | |
| 113.31.186.197 | 19 | China | |
| 210.22.220.9 | 2 | China | |
| 106.75.214.209 | 2 | China | |
| 106.75.241.127 | 2 | China | |
| 223.167.206.156 | 1 | China | |
| 140.206.194.222 | 1 | China | |
| 223.167.206.167 | 1 | China |
Where it comes from
| Country | Probes |
|---|---|
| China | 493 |
Client strings it sends
| User agent | Probes |
|---|---|
| Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K) | 10 |
| Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/601.1.27 | 6 |
| Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.21 | 1 |
| Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36 | 1 |
| Mozilla/5.0 (Linux; Android 5.0.2; vivo Y51 Build/LRX22G; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/48.0.2564.116 Mobile Safari/537.36 T7/10.7 baiduboxapp/10.7.0.10 (Baidu; P1 5.0. | 1 |
ASN report
ASN report
Loading