Port 999
HoneyLabs honeypots recorded 439 probes against destination port 999 from 91 distinct source IP addresses in the last 7 days.
First observed 2026-11-08 10:12, most recently 2026-11-15 05:19 (UTC).
What the sensors show
The sources sat in 30 networks across 17 countries. No single address sent more than 13% of them. The largest source network was AS14061 (DigitalOcean, LLC), with 43% of the probes from 4 addresses. 6 of the 25 busiest addresses are recognised research scanners.
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 191.102.172.146 | 56 | WhiteLabelColo | US |
| 68.183.165.35 | 47 | DigitalOcean, LLC | US |
| 165.22.139.65 | 47 | DigitalOcean, LLC | US |
| 104.248.126.47 | 47 | DigitalOcean, LLC | US |
| 206.189.207.67 | 47 | DigitalOcean, LLC | US |
| 62.210.216.121 | 20 | Scaleway SAS | FR |
| 51.159.213.98 | 20 | Scaleway SAS | FR |
| 80.94.92.130 | 12 | Unmanaged Ltd | RO |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS14061 | DigitalOcean, LLC | 188 | 4 |
| AS394474 | WhiteLabelColo | 56 | 1 |
| AS12876 | Scaleway SAS | 40 | 2 |
| AS21859 | Zenlayer Inc | 25 | 22 |
| AS51396 | Pfcloud UG (haftungsbeschrankt) | 19 | 7 |
| AS396982 | Google LLC | 17 | 16 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 277 |
| France | 42 |
| Portugal | 29 |
| The Netherlands | 15 |
| Romania | 12 |
| Japan | 12 |
Client strings seen on this port
| User agent | Probes |
|---|---|
| Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 | 29 |
| Python/3.12 aiohttp/3.14.5 | 29 |
| Mozilla/5.0 (compatible; scanner) | 27 |
| Go-http-client/1.1 | 26 |
| python-requests/2.34.2 | 20 |
Port report
Port report
Loading