AS24940: Hetzner Online GmbH
HoneyLabs honeypots recorded 97 probes from AS24940 (Hetzner Online GmbH) in the last 7 days, originating from 10 distinct source IP addresses.
First observed 2026-11-08 13:51, most recently 2026-11-15 12:04 (UTC).
What the sensors show
Probes arrived on 6 of the 7 days in this window. The busiest day was 2026-11-15, with 61. Its 10 addresses probed 31 distinct ports. The most probed was port 3389, with 13% of the probes. One address, 95.216.76.62, sent 56% of them. None of the 10 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 3389 | 13 |
| 3325 | 6 |
| 2524 | 6 |
| 2375 | 6 |
| 3375 | 6 |
| 8085 | 6 |
| 13393 | 6 |
| 12001 | 6 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 95.216.76.62 | 54 | Finland | |
| 2.29.148.153 | 12 | Finland | |
| 116.202.237.42 | 10 | Germany | |
| 188.245.254.209 | 6 | Germany | |
| 135.181.243.203 | 4 | Finland | |
| 95.217.98.45 | 3 | Finland | |
| 116.202.236.93 | 3 | Germany | |
| 95.217.98.35 | 2 | Finland |
Where it comes from
| Country | Probes |
|---|---|
| Finland | 76 |
| Germany | 21 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 | 3 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 | 3 |
| axios/1.2.5 | 2 |
| python-socketio | 1 |
ASN report
ASN report
Loading