Port 2016

HoneyLabs honeypots recorded 37 probes against destination port 2016 from 19 distinct source IP addresses in the last 7 days.

First observed 2026-11-01 15:49, most recently 2026-11-07 02:11 (UTC).

What the sensors show

The sources sat in 10 networks across 9 countries. No single address sent more than 24% of them. The largest source network was AS42397 (Bunea TELECOM SRL), with 24% of the probes from 1 address. 12 of the 19 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
193.29.13.1999Bunea TELECOM SRLRO
80.66.83.807Bashinskii Vadim RuslanovichRU
213.177.179.1953Feo Prest SRLIR
91.231.89.2192ONYPHE SASFR
185.136.15.1532AO ALMAZKZ
91.231.89.141ONYPHE SASFR
176.120.22.1791Proton66 OOORU
91.196.152.1141ONYPHE SASFR

Networks it comes from

ASNOrganisationProbesSource IPs
AS42397Bunea TELECOM SRL91
AS213412ONYPHE SAS87
AS216473Bashinskii Vadim Ruslanovich71
AS209334Modat B.V.33
AS208137Feo Prest SRL31
AS14987Rethem Hosting LLC22

Where it comes from

CountryProbes
France10
Romania9
Russia8
Iran3
Kazakhstan2
United States2

Client strings seen on this port

User agentProbes
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
curl/7.61.12
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 ModatScanner/1.2 (+https://modat.io/)2
Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0 Safari/600.1.251

Port report

Port report

Loading