Port 5443

HoneyLabs honeypots recorded 1,098 probes against destination port 5443 from 228 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 10:12, most recently 2026-11-15 08:29 (UTC).

What the sensors show

The sources sat in 31 networks across 16 countries. No single address sent more than 11% of them. The largest source network was AS210328 (AO ALMAZ), with 15% of the probes from 4 addresses. 7 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
77.91.71.91119Alferov Aleksey AleksandrovichRU
185.136.15.111119AO ALMAZKZ
185.136.15.11034AO ALMAZKZ
199.165.159.2528The Shadowserver Foundation, Inc.US
65.49.1.23224Hurricane Electric LLCUS
35.210.70.3922Google LLCBE
87.251.64.13218Shesternin Vladimir AnatolievichRU
45.227.254.7217Flyservers S.A.PA

Networks it comes from

ASNOrganisationProbesSource IPs
AS210328AO ALMAZ1704
AS6939Hurricane Electric LLC16945
AS15169Google LLC16824
AS22168The Shadowserver Foundation, Inc.16848
AS211486Alferov Aleksey Aleksandrovich1533
AS212835Shesternin Vladimir Anatolievich585

Where it comes from

CountryProbes
United States436
Russia211
Kazakhstan170
Belgium169
Singapore24
Romania19

Client strings seen on this port

User agentProbes
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36288
Mozilla/5.0 (compatible)152
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36100
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity31
Go-http-client/1.118

Port report

Port report

Loading