AS37963: Hangzhou Alibaba Advertising Co.,Ltd.
HoneyLabs honeypots recorded 6,241 probes from AS37963 (Hangzhou Alibaba Advertising Co.,Ltd.) in the last 7 days, originating from 88 distinct source IP addresses.
First observed 2026-11-05 22:33, most recently 2026-11-12 21:42 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-06, with 3,012. Its 88 addresses probed 767 distinct ports. The most probed was port 22, with 33% of the probes. No single address sent more than 10% of them. None of the 25 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 22 | 2,071 |
| 9119 | 35 |
| 2222 | 29 |
| 6629 | 22 |
| 24695 | 20 |
| 48172 | 16 |
| 57121 | 15 |
| 59065 | 14 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 121.43.230.7 | 613 | China | |
| 121.41.169.100 | 526 | China | |
| 121.43.116.46 | 519 | China | |
| 112.124.57.213 | 492 | China | |
| 47.97.3.14 | 481 | China | |
| 47.99.50.46 | 414 | China | |
| 121.41.165.223 | 373 | China | |
| 121.199.163.238 | 282 | China |
Where it comes from
| Country | Probes |
|---|---|
| China | 6,241 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) | 1,500 |
| Python-urllib/3.6 | 35 |
| go-dockerclient | 15 |
| Go-http-client/1.1 | 5 |
| curl/7.64.1 | 2 |
ASN report
ASN report
Loading