AS36352: HostPapa
HoneyLabs honeypots recorded 536 probes from AS36352 (HostPapa) in the last 7 days, originating from 23 distinct source IP addresses.
First observed 2026-11-07 21:06, most recently 2026-11-14 20:28 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-07, with 349. Its 23 addresses probed 45 distinct ports. The most probed was port 27017, with 66% of the probes. One address, 104.168.101.23, sent 65% of them. None of the 23 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 27017 | 352 |
| 8545 | 22 |
| 21 | 16 |
| 8642 | 12 |
| 990 | 8 |
| 6379 | 8 |
| 25565 | 7 |
| 9200 | 6 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 104.168.101.23 | 348 | United States | |
| 216.144.226.116 | 50 | United States | |
| 172.245.112.205 | 22 | United States | |
| 192.129.135.41 | 16 | United States | |
| 198.46.182.214 | 14 | United States | |
| 192.236.202.11 | 12 | United States | |
| 192.3.165.146 | 12 | United States | |
| 69.12.71.34 | 8 | United States |
Where it comes from
| Country | Probes |
|---|---|
| United States | 536 |
Client strings it sends
| User agent | Probes |
|---|---|
| l9explore/1.2.2 | 318 |
| Mozilla/5.0 Chrome/131.0 | 20 |
| Mozilla/5.0 Chrome/131 | 16 |
| zmap-proxy-probe/1.0 | 12 |
| Go-http-client/1.1 | 10 |
ASN report
ASN report
Loading