HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 636 (LDAPS)

HoneyLabs honeypots recorded 846 probes against destination port 636 (LDAPS) from 147 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 08:49, most recently 2026-11-15 07:01 (UTC).

What the sensors show

The sources sat in 27 networks across 12 countries. No single address sent more than 13% of them. The largest source network was AS202425 (IP Volume inc), with 31% of the probes from 5 addresses. 14 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
89.248.171.24111IP Volume incNL
93.174.93.1281IP Volume incNL
80.82.77.20244IP Volume incNL
147.182.210.20738DigitalOcean, LLCUS
67.205.140.23838DigitalOcean, LLCUS
24.199.88.12438DigitalOcean, LLCUS
18.218.118.20324Amazon.com, Inc.US
89.248.172.3322IP Volume incNL

Networks it comes from

ASNOrganisationProbesSource IPs
AS202425IP Volume inc2605
AS15169Google LLC19022
AS14061DigitalOcean, LLC1305
AS398324Censys, Inc.659
AS398705Censys, Inc.455
AS16509Amazon.com, Inc.435

Where it comes from

CountryProbes
United States357
The Netherlands260
Belgium190
France8
Bulgaria7
United Arab Emirates7

Client strings seen on this port

User agentProbes
Python/3.10 aiohttp/3.8.4250
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)72
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.3643
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.3619
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity13

Port report

Port report

Loading