HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 17000

HoneyLabs honeypots recorded 475 probes against destination port 17000 from 49 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 09:51, most recently 2026-11-15 06:40 (UTC).

What the sensors show

The sources sat in 19 networks across 12 countries. One address, 5.187.38.30, sent 39% of them. The largest source network was AS206264 (Amarutu Technology Ltd), with 44% of the probes from 2 addresses. 6 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
5.187.38.30186Amarutu Technology LtdHK
195.178.110.20475Techoff Srv LimitedBG
195.182.16.2322Amarutu Technology LtdDE
165.154.163.1018UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDUS
216.180.246.15116Google LLCUS
62.210.142.15916Scaleway SASFR
216.180.246.22716Google LLCUS
216.180.246.8016Google LLCUS

Networks it comes from

ASNOrganisationProbesSource IPs
AS206264Amarutu Technology Ltd2082
AS396982Google LLC7820
AS48090Techoff Srv Limited751
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED516
AS12876Scaleway SAS161
AS63199CDS Global Cloud Co., Ltd121

Where it comes from

CountryProbes
Hong Kong201
United States114
Bulgaria75
Germany22
United Kingdom19
France16

Client strings seen on this port

User agentProbes
Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)77
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.3635
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity17
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.012
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.06

Port report

Port report

Loading