AS6939: Hurricane Electric LLC
HoneyLabs honeypots recorded 15,224 probes from AS6939 (Hurricane Electric LLC) in the last 7 days, originating from 684 distinct source IP addresses.
First observed 2026-11-08 07:26, most recently 2026-11-15 07:25 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-14, with 2,320. Its 684 addresses probed 229 distinct ports. No port took more than 2% of the probes. No single address sent more than 3% of them. 25 of the 25 busiest addresses are recognised research scanners.
Ports it targets
| Port | Probes |
|---|---|
| 5665 | 260 |
| 65443 | 260 |
| 3000 | 259 |
| 9060 | 234 |
| 9090 | 229 |
| 443 | 224 |
| 4434 | 221 |
| 7443 | 221 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 216.218.206.67 | 436 | United States | |
| 65.49.20.68 | 425 | United States | |
| 184.105.139.69 | 366 | United States | |
| 65.49.20.66 | 364 | United States | |
| 65.49.20.69 | 354 | United States | |
| 65.49.20.67 | 342 | United States | |
| 184.105.139.68 | 332 | United States | |
| 216.218.206.69 | 323 | United States |
Where it comes from
| Country | Probes |
|---|---|
| United States | 15,224 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0 | 106 |
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0 | 97 |
| Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 SE 2.X MetaSr 1.0 | 96 |
| Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0 | 96 |
| Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 | 95 |
ASN report
ASN report
Loading