Port 65001

HoneyLabs honeypots recorded 86 probes against destination port 65001 from 37 distinct source IP addresses in the last 7 days.

First observed 2026-11-01 10:32, most recently 2026-11-08 02:55 (UTC).

What the sensors show

The sources sat in 11 networks across 8 countries. No single address sent more than 21% of them. The largest source network was AS400810 (BreezeHost), with 21% of the probes from 1 address. 7 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
31.56.20.12318BreezeHostUS
185.136.15.15312AO ALMAZKZ
167.94.146.618Censys, Inc.US
66.132.172.2087Censys, Inc.US
192.253.248.2513Limited Network LTDNL
204.76.203.403Pfcloud UG (haftungsbeschrankt)NL
162.216.149.1532Google LLCUS
204.76.203.442Pfcloud UG (haftungsbeschrankt)NL

Networks it comes from

ASNOrganisationProbesSource IPs
AS400810BreezeHost181
AS396982Google LLC1715
AS210328AO ALMAZ121
AS213412ONYPHE SAS88
AS51396Pfcloud UG (haftungsbeschrankt)85
AS398705Censys, Inc.81

Where it comes from

CountryProbes
United States43
Kazakhstan12
The Netherlands11
France8
United Kingdom7
Japan2

Client strings seen on this port

User agentProbes
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity17
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)11
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko1

Port report

Port report

Loading