Port 30123

HoneyLabs honeypots recorded 38 probes against destination port 30123 from 20 distinct source IP addresses in the last 7 days.

First observed 2026-10-31 22:33, most recently 2026-11-07 15:46 (UTC).

What the sensors show

The sources sat in 7 networks across 5 countries. No single address sent more than 16% of them. The largest source network was AS51396 (Pfcloud UG (haftungsbeschrankt)), with 32% of the probes from 7 addresses. 2 of the 20 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
68.183.209.1526DigitalOcean, LLCDE
147.182.211.1946DigitalOcean, LLCUS
93.123.109.1234Techoff Srv LimitedBG
204.76.203.533Pfcloud UG (haftungsbeschrankt)NL
204.76.203.383Pfcloud UG (haftungsbeschrankt)NL
204.76.203.402Pfcloud UG (haftungsbeschrankt)NL
204.76.203.2121Pfcloud UG (haftungsbeschrankt)NL
94.26.68.901MEVSPACE sp. z o.o.BG

Networks it comes from

ASNOrganisationProbesSource IPs
AS51396Pfcloud UG (haftungsbeschrankt)127
AS14061DigitalOcean, LLC122
AS212512Detai Prosperous Technologies Limited44
AS48090Techoff Srv Limited41
AS396982Google LLC33
AS14987Rethem Hosting LLC22

Where it comes from

CountryProbes
The Netherlands12
United States11
Germany8
Bulgaria5
United Kingdom2

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.3610
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity3
curl/7.61.12
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)1

Port report

Port report

Loading