HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 403

HoneyLabs honeypots recorded 383 probes against destination port 403 from 96 distinct source IP addresses in the last 7 days.

First observed 2026-10-31 01:56, most recently 2026-11-06 12:02 (UTC).

What the sensors show

The sources sat in 6 networks across 3 countries. No single address sent more than 8% of them. The largest source network was AS6939 (Hurricane Electric LLC), with 61% of the probes from 51 addresses. 24 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
199.165.159.17731The Shadowserver Foundation, Inc.US
65.49.20.6826Hurricane Electric LLCUS
65.49.20.6926Hurricane Electric LLCUS
65.49.1.19215Hurricane Electric LLCUS
45.141.233.1613MEVSPACE sp. z o.o.BG
74.82.47.513Hurricane Electric LLCUS
216.218.206.6713Hurricane Electric LLCUS
216.218.206.6913Hurricane Electric LLCUS

Networks it comes from

ASNOrganisationProbesSource IPs
AS6939Hurricane Electric LLC23251
AS22168The Shadowserver Foundation, Inc.13037
AS201814MEVSPACE sp. z o.o.152
AS63949Akamai Connected Cloud22
AS14987Rethem Hosting LLC22
AS209334Modat B.V.22

Where it comes from

CountryProbes
United States366
Bulgaria15
Canada2

Client strings seen on this port

User agentProbes
Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.012
Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.08
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.368
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.367
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/537.367

Port report

Port report

Loading