Port 9001 (Tor)
HoneyLabs honeypots recorded 1,417 probes against destination port 9001 (Tor) from 311 distinct source IP addresses in the last 7 days.
First observed 2026-11-08 08:40, most recently 2026-11-15 06:59 (UTC).
What the sensors show
The sources sat in 44 networks across 23 countries. No single address sent more than 9% of them. The largest source network was AS202425 (IP Volume inc), with 22% of the probes from 5 addresses. 8 of the 25 busiest addresses are recognised research scanners.
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 89.248.171.24 | 134 | IP Volume inc | NL |
| 93.174.93.12 | 96 | IP Volume inc | NL |
| 80.82.77.202 | 56 | IP Volume inc | NL |
| 95.164.110.199 | 56 | NJ IX | US |
| 128.1.132.220 | 42 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | HK |
| 152.32.170.55 | 39 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | HK |
| 89.248.172.33 | 24 | IP Volume inc | NL |
| 18.116.101.220 | 18 | Amazon.com, Inc. | US |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS202425 | IP Volume inc | 313 | 5 |
| AS135377 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | 284 | 34 |
| AS15169 | Google LLC | 105 | 15 |
| AS6939 | Hurricane Electric LLC | 90 | 38 |
| AS16509 | Amazon.com, Inc. | 61 | 9 |
| AS53856 | NJ IX | 56 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 452 |
| The Netherlands | 327 |
| Hong Kong | 241 |
| Belgium | 108 |
| Thailand | 40 |
| Portugal | 37 |
Client strings seen on this port
| User agent | Probes |
|---|---|
| Python/3.10 aiohttp/3.8.4 | 310 |
| Go-http-client/1.1 | 96 |
| Mozilla/5.0 (compatible) | 95 |
| Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity | 45 |
| visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 | 40 |
Port report
Port report
Loading