AS4837: CHINA UNICOM China169 Backbone
HoneyLabs honeypots recorded 2,057 probes from AS4837 (CHINA UNICOM China169 Backbone) in the last 7 days, originating from 676 distinct source IP addresses.
First observed 2026-11-07 16:48, most recently 2026-11-14 16:32 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-12, with 794. Its 676 addresses probed 427 distinct ports. The most probed was port 22, with 62% of the probes. No single address sent more than 21% of them. None of the 25 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 22 | 1,268 |
| 1433 | 101 |
| 6379 | 21 |
| 5555 | 11 |
| 5236 | 10 |
| 2375 | 9 |
| 80 | 8 |
| 3306 | 7 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 221.1.195.6 | 435 | China | |
| 221.10.42.66 | 425 | China | |
| 125.39.148.106 | 306 | China | |
| 116.177.174.231 | 67 | China | |
| 123.138.18.10 | 24 | China | |
| 101.206.108.14 | 12 | China | |
| 113.200.238.158 | 9 | China | |
| 116.171.64.17 | 9 | China |
Where it comes from
| Country | Probes |
|---|---|
| China | 2,057 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 zgrab/0.x | 14 |
| Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 | 6 |
| Hello, World | 6 |
| Hello-World | 3 |
| Go-http-client/1.1 | 2 |
ASN report
ASN report
Loading