Port 6666

HoneyLabs honeypots recorded 1,969 probes against destination port 6666 from 95 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 08:39, most recently 2026-11-15 07:34 (UTC).

What the sensors show

The sources sat in 35 networks across 19 countries. One address, 185.177.72.64, sent 52% of them. The largest source network was AS211590 (Bucklog SARL), with 52% of the probes from 1 address. 2 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
185.177.72.641,016Bucklog SARLFR
77.90.185.243680Limited Network LTDDE
152.32.189.12818UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDHK
206.71.148.18118BL NetworksGB
164.92.211.9812DigitalOcean, LLCNL
106.75.17.23811China Unicom Beijing Province NetworkCN
80.66.83.439Bashinskii Vadim RuslanovichRU
80.66.83.807Bashinskii Vadim RuslanovichRU

Networks it comes from

ASNOrganisationProbesSource IPs
AS211590Bucklog SARL1,0161
AS213790Limited Network LTD6801
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED518
AS14061DigitalOcean, LLC4513
AS51396Pfcloud UG (haftungsbeschrankt)187
AS399629BL Networks181

Where it comes from

CountryProbes
France1,023
Germany692
United States64
Hong Kong47
The Netherlands33
United Kingdom28

Client strings seen on this port

User agentProbes
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.19) Gecko/20081213 SUSE/2.0.0.19-0.1 Firefox/2.0.0.19127
Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/534.34 (KHTML, like Gecko) PhantomJS/1.9.7 Safari/534.34127
Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_3; en-us) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.1 Safari/525.20127
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36127
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; fr-fr) AppleWebKit/125.5.5 (KHTML, like Gecko) Safari/125.11127

Port report

Port report

Loading