HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 993 (IMAPS)

HoneyLabs honeypots recorded 831 probes against destination port 993 (IMAPS) from 165 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 10:23, most recently 2026-11-15 05:46 (UTC).

What the sensors show

The sources sat in 26 networks across 19 countries. No single address sent more than 3% of them. The largest source network was AS15169 (Google LLC), with 74% of the probes from 49 addresses. 1 of the 25 busiest addresses is a recognised research scanner.

Most active source addresses

Source IPProbesNetworkCountry
35.210.40.22822Google LLCBE
35.206.136.13522Google LLCBE
35.210.143.14922Google LLCBE
35.206.161.10622Google LLCBE
35.210.33.6122Google LLCBE
35.210.42.2922Google LLCBE
35.210.98.10422Google LLCBE
35.210.220.920Google LLCBE

Networks it comes from

ASNOrganisationProbesSource IPs
AS15169Google LLC61849
AS8075Microsoft Corporation3531
AS16509Amazon.com, Inc.286
AS14061DigitalOcean, LLC2715
AS396982Google LLC2222
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED205

Where it comes from

CountryProbes
Belgium618
United States101
United Arab Emirates19
United Kingdom15
Hong Kong14
Kazakhstan11

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.3657
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.3625
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3614
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.3610
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.06

Port report

Port report

Loading