HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 444

HoneyLabs honeypots recorded 2,343 probes against destination port 444 from 212 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 08:54, most recently 2026-11-15 07:34 (UTC).

What the sensors show

The sources sat in 40 networks across 21 countries. One address, 80.94.95.211, sent 66% of them. The largest source network was AS204428 (SS-Net), with 67% of the probes from 2 addresses. 17 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
80.94.95.2111,554SS-NetRO
191.102.156.6856WhiteLabelColoUS
77.91.71.9251Alferov Aleksey AleksandrovichRU
77.91.71.9051Alferov Aleksey AleksandrovichRU
185.136.15.234AO ALMAZKZ
92.118.39.18127Unmanaged LtdRO
18.218.118.20323Amazon.com, Inc.US
18.116.101.22018Amazon.com, Inc.US

Networks it comes from

ASNOrganisationProbesSource IPs
AS204428SS-Net1,5602
AS22168The Shadowserver Foundation, Inc.19365
AS211486Alferov Aleksey Aleksandrovich1022
AS6939Hurricane Electric LLC635
AS394474WhiteLabelColo572
AS16509Amazon.com, Inc.564

Where it comes from

CountryProbes
Romania1,598
United States482
Russia118
Kazakhstan35
Portugal18
United Kingdom10

Client strings seen on this port

User agentProbes
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)259
Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120403211507 Firefox/12.0259
Mozilla/5.0 (Windows NT 6.1; rv:6.0) Gecko/20110814 Firefox/41.0.7259
Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; Sprint:SPH-ip320; Smartphone; 176x220)259
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36 OPR/28.0.1750.48 (Edition Campaign 49)259

Port report

Port report

Loading