Port 2376 (Docker-TLS)

HoneyLabs honeypots recorded 1,880 probes against destination port 2376 (Docker-TLS) from 131 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 12:37, most recently 2026-11-15 07:16 (UTC).

What the sensors show

The sources sat in 45 networks across 17 countries. One address, 185.177.72.64, sent 41% of them. The largest source network was AS213790 (Limited Network LTD), with 41% of the probes from 1 address. 14 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
185.177.72.64762Bucklog SARLFR
77.90.185.243762Limited Network LTDDE
44.220.188.23213Amazon.com, Inc.US
44.220.188.18513Amazon.com, Inc.US
44.220.188.1813Amazon.com, Inc.US
170.231.236.9811GRUPO PANAGLOBAL 15 S.APA
209.99.188.1749SKN Subnet & Telecom LtdCH
66.132.172.418Censys, Inc.US

Networks it comes from

ASNOrganisationProbesSource IPs
AS213790Limited Network LTD7621
AS211590Bucklog SARL7621
AS398324Censys, Inc.537
AS15169Google LLC4216
AS14618Amazon.com, Inc.393
AS398705Censys, Inc.324

Where it comes from

CountryProbes
France774
Germany763
United States181
Belgium45
China34
Panama19

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/528.4+ (KHTML, like Gecko) Version/3.1.2 Safari/525.20.1127
Mozilla/5.0 (Linux; Android 7.0; LG-H918 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36127
Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3127
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; MCIT 1.0)127
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36127

Port report

Port report

Loading