AS9808: China Mobile Communications Group Co., Ltd.
HoneyLabs honeypots recorded 6,546 probes from AS9808 (China Mobile Communications Group Co., Ltd.) in the last 7 days, originating from 43 distinct source IP addresses.
First observed 2026-11-08 06:51, most recently 2026-11-15 06:00 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-10, with 4,513. Its 43 addresses probed 1,979 distinct ports. The most probed was port 113, with 11% of the probes. One address, 117.181.50.98, sent 62% of them. None of the 25 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 113 | 739 |
| 445 | 44 |
| 8443 | 35 |
| 8080 | 33 |
| 8088 | 30 |
| 1433 | 28 |
| 80 | 27 |
| 443 | 25 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 117.181.50.98 | 4,033 | China | |
| 183.204.62.124 | 632 | China | |
| 183.204.62.122 | 616 | China | |
| 183.204.62.121 | 609 | China | |
| 183.204.62.123 | 556 | China | |
| 183.223.82.230 | 12 | China | |
| 117.157.109.56 | 8 | China | |
| 39.129.148.151 | 8 | China |
Where it comes from
| Country | Probes |
|---|---|
| China | 6,546 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 | 2,413 |
| Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) | 168 |
| model-catalog/1.0 | 11 |
| AnyConnect Darwin_i386 3.1.05160 | 5 |
| Python WinRM client | 1 |
ASN report
ASN report
Loading