AS204428: SS-Net
HoneyLabs honeypots recorded 39,266 probes from AS204428 (SS-Net) in the last 7 days, originating from 9 distinct source IP addresses.
First observed 2026-11-07 05:12, most recently 2026-11-14 00:11 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-11, with 13,066. Its 9 addresses probed 3,450 distinct ports. No port took more than 5% of the probes. One address, 80.94.95.211, sent 84% of them. None of the 9 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 4433 | 2,079 |
| 51005 | 2,072 |
| 3702 | 2,072 |
| 2072 | 2,072 |
| 1900 | 2,072 |
| 448 | 2,072 |
| 447 | 2,072 |
| 446 | 2,072 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 80.94.95.211 | 32,882 | Romania | |
| 80.94.95.237 | 3,253 | Romania | |
| 80.94.95.223 | 1,879 | Romania | |
| 80.94.95.123 | 505 | Romania | |
| 80.94.95.83 | 453 | Romania | |
| 80.94.95.115 | 137 | Romania | |
| 80.94.95.116 | 136 | Romania | |
| 80.94.95.14 | 12 | Romania |
Where it comes from
| Country | Probes |
|---|---|
| Romania | 39,266 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 (Linux; U; Android 4.1.1; en-us; Build/JRO03C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 | 259 |
| Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0 | 259 |
| Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36 OPR/38.0.2220.31 | 259 |
| Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.96 Safari/537.36 | 259 |
| Mozilla/5.0 (X11; U; SunOS i86pc; fr; rv:1.9.0.4) Gecko/2008111710 Firefox/3.0.4 | 259 |
ASN report
ASN report
Loading