AS21859: Zenlayer Inc
HoneyLabs honeypots recorded 3,472 probes from AS21859 (Zenlayer Inc) in the last 7 days, originating from 277 distinct source IP addresses.
First observed 2026-11-05 14:22, most recently 2026-11-12 13:37 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-06, with 637. Its 277 addresses probed 380 distinct ports. No port took more than 2% of the probes. No single address sent more than 3% of them. 25 of the 25 busiest addresses are recognised research scanners.
Ports it targets
| Port | Probes |
|---|---|
| 8443 | 77 |
| 81 | 57 |
| 12579 | 52 |
| 9398 | 52 |
| 3951 | 44 |
| 3067 | 44 |
| 443 | 42 |
| 53 | 36 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 185.180.141.90 | 120 | Portugal | |
| 185.180.141.47 | 118 | Portugal | |
| 185.226.196.12 | 100 | Portugal | |
| 109.105.210.72 | 99 | Portugal | |
| 185.226.197.37 | 96 | Portugal | |
| 185.226.197.32 | 95 | Portugal | |
| 185.226.197.7 | 93 | Portugal | |
| 109.105.210.57 | 93 | Portugal |
Where it comes from
| Country | Probes |
|---|---|
| Portugal | 3,470 |
| Hong Kong | 1 |
| United Kingdom | 1 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 | 1,796 |
| python-httpx/0.28.1 | 1,360 |
| Mozilla/5.0 (compatible; kops-portpool-2026-11-08) | 1 |
| Python-urllib/3.11 | 1 |
ASN report
ASN report
Loading