Port 6789

HoneyLabs honeypots recorded 164 probes against destination port 6789 from 51 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 16:49, most recently 2026-11-15 08:18 (UTC).

What the sensors show

The sources sat in 15 networks across 10 countries. One address, 191.102.176.185, sent 34% of them. The largest source network was AS394474 (WhiteLabelColo), with 35% of the probes from 2 addresses. 2 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
191.102.176.18556WhiteLabelColoUS
138.226.239.78HOSTRAMGB
213.177.179.1956Feo Prest SRLIR
36.156.22.26China Mobile communications corporationCN
142.93.43.156DigitalOcean, LLCGB
148.153.188.2546CDS Global Cloud Co., LtdUS
150.107.38.2516UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDHK
185.242.226.604IP Volume incUS

Networks it comes from

ASNOrganisationProbesSource IPs
AS394474WhiteLabelColo572
AS14061DigitalOcean, LLC3013
AS396982Google LLC1412
AS9808China Mobile Communications Group Co., Ltd.94
AS403092HOSTRAM81
AS208137Feo Prest SRL61

Where it comes from

CountryProbes
United States105
United Kingdom22
China15
Iran6
Hong Kong6
France3

Client strings seen on this port

User agentProbes
Python/3.12 aiohttp/3.14.529
Mozilla/5.0 (compatible; scanner)27
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3620
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.3615
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity14

Port report

Port report

Loading