HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 23 (Telnet)

HoneyLabs honeypots recorded 1,666 probes against destination port 23 (Telnet) from 173 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 10:19, most recently 2026-11-15 06:01 (UTC).

What the sensors show

The sources sat in 45 networks across 25 countries. No single address sent more than 24% of them. The largest source network was AS15169 (Google LLC), with 33% of the probes from 53 addresses. None of the 25 busiest addresses is a recognised research scanner.

Most active source addresses

Source IPProbesNetworkCountry
134.209.108.59396DigitalOcean, LLCSG
180.93.193.100385Sai gon Postel CorporationVN
191.44.112.7646Node Host LimitedDE
36.255.97.3933BlatantPK
35.210.48.4618Google LLCBE
35.210.187.21418Google LLCBE
35.210.240.6818Google LLCBE
35.206.134.3018Google LLCBE

Networks it comes from

ASNOrganisationProbesSource IPs
AS15169Google LLC55853
AS14061DigitalOcean, LLC4066
AS7602Sai gon Postel Corporation3851
AS198550Node Host Limited461
AS403005Blatant331
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED284

Where it comes from

CountryProbes
Belgium558
Singapore396
Vietnam393
United States88
Germany56
Russia38

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.3662
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.3611
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)10
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.366
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.06

Port report

Port report

Loading