Port 6000 (X11)
HoneyLabs honeypots recorded 659 probes against destination port 6000 (X11) from 155 distinct source IP addresses in the last 7 days.
First observed 2026-11-08 08:52, most recently 2026-11-15 06:20 (UTC).
What the sensors show
The sources sat in 42 networks across 16 countries. No single address sent more than 8% of them. The largest source network was AS14061 (DigitalOcean, LLC), with 39% of the probes from 33 addresses. 12 of the 25 busiest addresses are recognised research scanners.
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 95.164.203.148 | 56 | ISP4Life INC | US |
| 157.230.10.72 | 47 | DigitalOcean, LLC | US |
| 165.227.61.60 | 47 | DigitalOcean, LLC | US |
| 69.164.192.147 | 47 | Akamai Connected Cloud | US |
| 167.99.136.190 | 21 | DigitalOcean, LLC | DE |
| 104.248.252.37 | 21 | DigitalOcean, LLC | DE |
| 142.93.100.179 | 21 | DigitalOcean, LLC | DE |
| 164.92.251.84 | 21 | DigitalOcean, LLC | DE |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS14061 | DigitalOcean, LLC | 260 | 33 |
| AS398324 | Censys, Inc. | 62 | 7 |
| AS394814 | ISP4Life INC | 56 | 1 |
| AS63949 | Akamai Connected Cloud | 49 | 3 |
| AS396982 | Google LLC | 39 | 38 |
| AS398705 | Censys, Inc. | 27 | 3 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 399 |
| Germany | 141 |
| Russia | 25 |
| United Arab Emirates | 17 |
| The Netherlands | 15 |
| Hong Kong | 12 |
Client strings seen on this port
| User agent | Probes |
|---|---|
| Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) | 59 |
| Python/3.12 aiohttp/3.14.5 | 29 |
| Mozilla/5.0 (compatible; scanner) | 27 |
| Go-http-client/1.1 | 26 |
| Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) | 15 |
Port report
Port report
Loading