HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 8005

HoneyLabs honeypots recorded 191 probes against destination port 8005 from 94 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 19:25, most recently 2026-11-15 17:41 (UTC).

What the sensors show

The sources sat in 21 networks across 12 countries. One address, 18.116.101.220, sent 25% of them. The largest source network was AS16509 (Amazon.com, Inc.), with 41% of the probes from 5 addresses. 11 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
18.116.101.22047Amazon.com, Inc.US
3.131.220.12112Amazon.com, Inc.US
18.218.118.20310Amazon.com, Inc.US
209.38.46.515DigitalOcean, LLCNL
3.130.168.25Amazon.com, Inc.US
161.35.126.365DigitalOcean, LLCUS
104.248.210.244DigitalOcean, LLCUS
3.129.187.384Amazon.com, Inc.US

Networks it comes from

ASNOrganisationProbesSource IPs
AS16509Amazon.com, Inc.785
AS396982Google LLC3636
AS8075Microsoft Corporation1616
AS14061DigitalOcean, LLC143
AS213412ONYPHE SAS87
AS51396Pfcloud UG (haftungsbeschrankt)63

Where it comes from

CountryProbes
United States160
The Netherlands11
Germany4
Romania3
Ukraine3
Belgium2

Client strings seen on this port

User agentProbes
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.3658
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity34
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.3610
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.08
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.364

Port report

Port report

Loading