HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 1900

HoneyLabs honeypots recorded 2,240 probes against destination port 1900 from 74 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 08:34, most recently 2026-11-15 07:20 (UTC).

What the sensors show

The sources sat in 19 networks across 8 countries. One address, 80.94.95.211, sent 93% of them. The largest source network was AS204428 (SS-Net), with 93% of the probes from 1 address. 1 of the 25 busiest addresses is a recognised research scanner.

Most active source addresses

Source IPProbesNetworkCountry
80.94.95.2112,072SS-NetRO
134.195.155.17056GLOBALHOSTINGSOLUTIONS INCUS
209.38.37.1016DigitalOcean, LLCNL
68.183.132.2216DigitalOcean, LLCUS
31.57.37.556VPS Dedicated LLCAE
66.240.236.1164CariNet, Inc.US
204.76.203.2134Pfcloud UG (haftungsbeschrankt)NL
204.76.203.2123Pfcloud UG (haftungsbeschrankt)NL

Networks it comes from

ASNOrganisationProbesSource IPs
AS204428SS-Net2,0721
AS46918GLOBALHOSTINGSOLUTIONS INC561
AS396982Google LLC1815
AS51396Pfcloud UG (haftungsbeschrankt)188
AS8075Microsoft Corporation1515
AS14061DigitalOcean, LLC122

Where it comes from

CountryProbes
Romania2,074
United States115
The Netherlands24
China7
United Kingdom7
United Arab Emirates6

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Linux; Android 7.1.2; Redmi 5A Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.137 Mobile Safari/537.36259
Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0.1259
Mozilla/5.0 (X11; U; Linux i686; nb-NO; rv:1.8.1.3) Gecko/20070310 Firefox/2.0.0.3 (Debian-2.0.0.3-1)259
Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1259
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36 OPR/46.0.2597.32259

Port report

Port report

Loading