Port 9869

HoneyLabs honeypots recorded 40 probes against destination port 9869 from 29 distinct source IP addresses in the last 7 days.

First observed 2026-11-01 23:29, most recently 2026-11-08 14:11 (UTC).

What the sensors show

The sources sat in 9 networks across 7 countries. No single address sent more than 10% of them. The largest source network was AS396982 (Google LLC), with 43% of the probes from 17 addresses. 2 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
185.242.226.734IP Volume incUS
118.193.59.153UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDDE
152.32.133.1033UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDHK
106.75.17.2383China Unicom Beijing Province NetworkCN
98.80.4.632Amazon.com, Inc.US
192.161.49.22HostPapaUS
162.216.149.511Google LLCUS
45.131.155.1011Detai Prosperous Technologies LimitedUS

Networks it comes from

ASNOrganisationProbesSource IPs
AS396982Google LLC1717
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED62
AS212512Detai Prosperous Technologies Limited44
AS202425IP Volume inc41
AS4808China Unicom Beijing Province Network31
AS23273HostPapa21

Where it comes from

CountryProbes
United States17
United Kingdom9
Germany6
Hong Kong3
China3
Russia1

Client strings seen on this port

User agentProbes
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity17
curl/7.29.04
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.364
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.02

Port report

Port report

Loading