AS51396: Pfcloud UG (haftungsbeschrankt)
HoneyLabs honeypots recorded 39,628 probes from AS51396 (Pfcloud UG (haftungsbeschrankt)) in the last 7 days, originating from 62 distinct source IP addresses.
First observed 2026-11-08 07:46, most recently 2026-11-15 07:45 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-14, with 7,532. Its 62 addresses probed 12,585 distinct ports. No port took more than 1% of the probes. No single address sent more than 15% of them. None of the 25 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 11421 | 308 |
| 80 | 106 |
| 443 | 96 |
| 8080 | 93 |
| 8000 | 89 |
| 8888 | 83 |
| 25565 | 79 |
| 81 | 74 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 204.76.203.231 | 6,135 | The Netherlands | |
| 204.76.203.213 | 5,624 | The Netherlands | |
| 204.76.203.212 | 5,573 | The Netherlands | |
| 204.76.203.221 | 5,571 | The Netherlands | |
| 204.76.203.214 | 5,494 | The Netherlands | |
| 204.76.203.4 | 2,565 | The Netherlands | |
| 204.76.203.222 | 1,276 | The Netherlands | |
| 204.76.203.44 | 905 | The Netherlands |
Where it comes from
| Country | Probes |
|---|---|
| The Netherlands | 38,294 |
| Germany | 885 |
| Ukraine | 429 |
| United Arab Emirates | 20 |
Client strings it sends
| User agent | Probes |
|---|---|
| curl/8.4.0 | 163 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 | 156 |
| Mozilla/5.0 zgrab/0.x | 126 |
| Go-http-client/1.1 | 100 |
| 0day | 82 |
ASN report
ASN report
Loading