Port 2089

HoneyLabs honeypots recorded 55 probes against destination port 2089 from 40 distinct source IP addresses in the last 7 days.

First observed 2026-11-09 04:33, most recently 2026-11-15 16:43 (UTC).

What the sensors show

The sources sat in 10 networks across 9 countries. No single address sent more than 5% of them. The largest source network was AS396982 (Google LLC), with 35% of the probes from 16 addresses. 5 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
204.76.203.2143Pfcloud UG (haftungsbeschrankt)NL
204.76.203.2133Pfcloud UG (haftungsbeschrankt)NL
165.154.10.1873UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDNG
204.76.203.2213Pfcloud UG (haftungsbeschrankt)NL
152.32.169.73UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDHK
162.216.149.492Google LLCUS
162.216.150.872Google LLCUS
147.185.133.1762Google LLCUS

Networks it comes from

ASNOrganisationProbesSource IPs
AS396982Google LLC1916
AS51396Pfcloud UG (haftungsbeschrankt)147
AS213412ONYPHE SAS88
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED62
AS14987Rethem Hosting LLC22
AS45102Alibaba (US) Technology Co., Ltd.21

Where it comes from

CountryProbes
United States19
The Netherlands14
France8
United Kingdom5
Hong Kong3
Nigeria3

Client strings seen on this port

User agentProbes
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity19
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
curl/7.29.04
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.362
curl/7.61.12

Port report

Port report

Loading