Port 5011

HoneyLabs honeypots recorded 54 probes against destination port 5011 from 40 distinct source IP addresses in the last 7 days.

First observed 2026-11-09 00:28, most recently 2026-11-15 09:27 (UTC).

What the sensors show

The sources sat in 12 networks across 7 countries. No single address sent more than 13% of them. The largest source network was AS396982 (Google LLC), with 33% of the probes from 18 addresses. 8 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
66.132.159.967Censys, Inc.US
151.243.11.1806LLC Vash Kredit BankAE
204.76.203.2143Pfcloud UG (haftungsbeschrankt)NL
204.76.203.2212Pfcloud UG (haftungsbeschrankt)NL
162.216.149.1221Google LLCUS
147.185.132.2451Google LLCUS
35.203.210.981Google LLCGB
31.14.32.41NewVM B.V.NL

Networks it comes from

ASNOrganisationProbesSource IPs
AS396982Google LLC1818
AS213412ONYPHE SAS88
AS398324Censys, Inc.71
AS209630LLC Vash Kredit Bank61
AS51396Pfcloud UG (haftungsbeschrankt)63
AS209334Modat B.V.22

Where it comes from

CountryProbes
United States32
The Netherlands7
United Arab Emirates6
United Kingdom4
France2
Portugal2

Client strings seen on this port

User agentProbes
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity18
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)6
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)5
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.362

Port report

Port report

Loading