Port 26

HoneyLabs honeypots recorded 276 probes against destination port 26 from 73 distinct source IP addresses in the last 7 days.

First observed 2026-11-01 18:17, most recently 2026-11-08 13:05 (UTC).

What the sensors show

The sources sat in 23 networks across 15 countries. No single address sent more than 17% of them. The largest source network was AS14061 (DigitalOcean, LLC), with 38% of the probes from 4 addresses. 7 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
45.79.2.23246Akamai Connected CloudUS
137.184.216.11146DigitalOcean, LLCUS
134.209.112.25246DigitalOcean, LLCUS
45.141.233.169MEVSPACE sp. z o.o.BG
118.193.47.2237UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDHK
165.154.36.1077UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDUS
152.32.199.337UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDBR
118.193.65.2097UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDGB

Networks it comes from

ASNOrganisationProbesSource IPs
AS14061DigitalOcean, LLC1044
AS63949Akamai Connected Cloud483
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED284
AS45102Alibaba (US) Technology Co., Ltd.148
AS8075Microsoft Corporation1414
AS213412ONYPHE SAS1212

Where it comes from

CountryProbes
United States192
Bulgaria14
The Netherlands9
France9
United Kingdom7
Germany7

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.016
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.3612
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3610
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.366

Port report

Port report

Loading