HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 9091

HoneyLabs honeypots recorded 1,532 probes against destination port 9091 from 124 distinct source IP addresses in the last 7 days.

First observed 2026-11-09 00:04, most recently 2026-11-15 23:17 (UTC).

What the sensors show

The sources sat in 36 networks across 19 countries. One address, 185.177.72.64, sent 66% of them. The largest source network was AS211590 (Bucklog SARL), with 66% of the probes from 1 address. 10 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
185.177.72.641,016Bucklog SARLFR
89.248.171.2476IP Volume incNL
134.195.152.19956GLOBALHOSTINGSOLUTIONS INCUS
93.174.93.1250IP Volume incNL
18.116.101.22047Amazon.com, Inc.US
80.82.77.20229IP Volume incNL
18.218.118.20320Amazon.com, Inc.US
170.231.236.9813GRUPO PANAGLOBAL 15 S.APA

Networks it comes from

ASNOrganisationProbesSource IPs
AS211590Bucklog SARL1,0161
AS202425IP Volume inc1614
AS16509Amazon.com, Inc.864
AS46918GLOBALHOSTINGSOLUTIONS INC572
AS396982Google LLC4947
AS264617GRUPO PANAGLOBAL 15 S.A323

Where it comes from

CountryProbes
France1,018
United States217
The Netherlands181
Panama25
Canada14
Russia13

Client strings seen on this port

User agentProbes
Python/3.10 aiohttp/3.8.4161
Mozilla/5.0 (Linux U; en-US) AppleWebKit/528.5 (KHTML, like Gecko, Safari/528.5 ) Version/4.0 Kindle/3.0 (screen 600x800; rotate)127
Mozilla/5.0 (Linux; Android 7.0; BLL-L22 Build/HUAWEIBLL-L22) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36127
Opera/9.51 (Windows NT 5.1; U; da)127
Mozilla/5.0 (Linux; Android 4.4.2; C6725 Build/KVT49L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36127

Port report

Port report

Loading