HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 21 (FTP)

HoneyLabs honeypots recorded 1,719 probes against destination port 21 (FTP) from 150 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 09:58, most recently 2026-11-15 05:09 (UTC).

What the sensors show

The sources sat in 36 networks across 22 countries. One address, 211.20.51.25, sent 54% of them. The largest source network was AS3462 (Data Communication Business Group), with 54% of the probes from 1 address. 1 of the 25 busiest addresses is a recognised research scanner.

Most active source addresses

Source IPProbesNetworkCountry
211.20.51.25930Data Communication Business GroupTW
35.206.185.16240Google LLCBE
35.210.11.1730Google LLCBE
2.36.216.6524FastwebIT
35.206.184.4120Google LLCBE
35.206.134.3020Google LLCBE
35.210.93.9720Google LLCBE
35.210.43.14320Google LLCBE

Networks it comes from

ASNOrganisationProbesSource IPs
AS3462Data Communication Business Group9301
AS15169Google LLC55040
AS8075Microsoft Corporation3535
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED346
AS30722Fastweb241
AS14061DigitalOcean, LLC189

Where it comes from

CountryProbes
Taiwan930
Belgium550
United States101
Italy24
United Arab Emirates18
Hong Kong16

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.3655
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.3624
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.3611
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)10
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.08

Port report

Port report

Loading