HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 5999

HoneyLabs honeypots recorded 117 probes against destination port 5999 from 27 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 15:19, most recently 2026-11-15 10:02 (UTC).

What the sensors show

The sources sat in 13 networks across 9 countries. One address, 134.195.153.105, sent 48% of them. The largest source network was AS46918 (GLOBALHOSTINGSOLUTIONS INC), with 48% of the probes from 1 address. 6 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
134.195.153.10556GLOBALHOSTINGSOLUTIONS INCUS
80.94.95.12318SS-NetRO
87.251.64.1276Shesternin Vladimir AnatolievichRU
87.251.64.1286Shesternin Vladimir AnatolievichRU
87.251.64.1324Shesternin Vladimir AnatolievichRU
87.251.64.1262Shesternin Vladimir AnatolievichRU
176.65.149.1712Pfcloud UG (haftungsbeschrankt)NL
204.76.203.2132Pfcloud UG (haftungsbeschrankt)NL

Networks it comes from

ASNOrganisationProbesSource IPs
AS46918GLOBALHOSTINGSOLUTIONS INC561
AS204428SS-Net181
AS212835Shesternin Vladimir Anatolievich184
AS51396Pfcloud UG (haftungsbeschrankt)85
AS213412ONYPHE SAS88
AS208137Feo Prest SRL21

Where it comes from

CountryProbes
United States57
Russia19
Romania18
The Netherlands9
France8
Iran3

Client strings seen on this port

User agentProbes
Python/3.12 aiohttp/3.14.529
Mozilla/5.0 (compatible; scanner)27
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.3619
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
anothers/0.11

Port report

Port report

Loading