Port 1181

HoneyLabs honeypots recorded 61 probes against destination port 1181 from 22 distinct source IP addresses in the last 7 days.

First observed 2026-10-28 22:13, most recently 2026-11-04 18:27 (UTC).

What the sensors show

The sources sat in 10 networks across 8 countries. No single address sent more than 20% of them. The largest source network was AS135377 (UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED), with 20% of the probes from 2 addresses. 14 of the 22 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
185.136.15.15312AO ALMAZKZ
167.94.146.568Censys, Inc.US
154.197.56.1636UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDSC
148.153.188.2546CDS Global Cloud Co., LtdUS
148.153.188.2466CDS Global Cloud Co., LtdUS
165.154.163.106UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDUS
94.26.68.902MEVSPACE sp. z o.o.BG
91.231.89.1001ONYPHE SASFR

Networks it comes from

ASNOrganisationProbesSource IPs
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED122
AS63199CDS Global Cloud Co., Ltd122
AS210328AO ALMAZ121
AS213412ONYPHE SAS88
AS398705Censys, Inc.81
AS209334Modat B.V.44

Where it comes from

CountryProbes
United States27
Kazakhstan12
France10
Seychelles6
Canada2
Bulgaria2

Client strings seen on this port

User agentProbes
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.3620
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)6
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 ModatScanner/1.2 (+https://modat.io/)3
curl/7.61.11

Port report

Port report

Loading live data…