AS401626: Netiface America, Inc.
HoneyLabs honeypots recorded 169 probes from AS401626 (Netiface America, Inc.) in the last 7 days, originating from 18 distinct source IP addresses.
First observed 2026-11-08 10:51, most recently 2026-11-15 07:38 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-14, with 30. Its 18 addresses probed 22 distinct ports. The most probed was port 27017, with 51% of the probes. No single address sent more than 16% of them. None of the 18 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 27017 | 87 |
| 5432 | 31 |
| 443 | 12 |
| 4153 | 4 |
| 22 | 4 |
| 999 | 3 |
| 5678 | 3 |
| 7890 | 3 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 64.89.163.235 | 27 | United States | |
| 64.89.163.131 | 18 | United States | |
| 64.89.163.85 | 16 | United States | |
| 64.89.163.132 | 15 | United States | |
| 64.89.163.130 | 15 | United States | |
| 64.89.163.87 | 12 | United States | |
| 64.89.163.86 | 11 | United States | |
| 23.132.164.201 | 10 | United States |
Where it comes from
| Country | Probes |
|---|---|
| United States | 161 |
| United Arab Emirates | 8 |
Client strings it sends
| User agent | Probes |
|---|---|
| Python/3.12 python-socks/2.3.0 | 18 |
| Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Safari/537.36 | 1 |
| Mozilla/5.0 (Android 6.0.1; Mobile; rv:48.0) Gecko/48.0 Firefox/48.0 | 1 |
| Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3844.0 Safari/537.36 | 1 |
| Opera/9.80 (X11; Linux x86_64; U; pl) Presto/2.7.62 Version/11.00 | 1 |
ASN report
ASN report
Loading