HoneyLabs
KEV
LookupKEVMCP
Data
The datasetDataset and methodCVEsCampaignsPayloadsPre-disclosureEmissions IndexPortsBlog
Integrations
OverviewFeeds
PricingDocs

Port 9999

HoneyLabs honeypots recorded 1,503 probes against destination port 9999 from 225 distinct source IP addresses in the last 7 days.

First observed 2026-11-08 09:45, most recently 2026-11-15 08:17 (UTC).

What the sensors show

The sources sat in 52 networks across 23 countries. One address, 185.177.72.64, sent 51% of them. The largest source network was AS211590 (Bucklog SARL), with 51% of the probes from 1 address. 13 of the 25 busiest addresses are recognised research scanners.

Most active source addresses

Source IPProbesNetworkCountry
185.177.72.64762Bucklog SARLFR
186.179.62.8256Corporacion Dana S.A.US
18.116.101.22029Amazon.com, Inc.US
206.71.148.18122BL NetworksGB
206.71.149.9718BL NetworksGB
66.132.195.19818Censys, Inc.US
185.136.15.216AO ALMAZKZ
35.210.207.10515Google LLCBE

Networks it comes from

ASNOrganisationProbesSource IPs
AS211590Bucklog SARL7621
AS398324Censys, Inc.10510
AS52393Corporacion Dana S.A.561
AS15169Google LLC524
AS398705Censys, Inc.505
AS16509Amazon.com, Inc.504

Where it comes from

CountryProbes
France768
United States393
Hong Kong55
Belgium53
United Kingdom51
The Netherlands34

Client strings seen on this port

User agentProbes
Mozilla/5.0 (Linux; Android 5.1.1; SM-T330NU Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36127
Mozilla/5.0 (Linux; U; Android 4.4.4; he-il; m1 note Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Mobile Safari/537.36127
Mozilla/5.0 (Android 5.1.1; Mobile; rv:41.0) Gecko/41.0 Firefox/41.0127
Mozilla/5.0 (Linux; Android 4.2.2; en-us; SAMSUNG SPH-L600 Build/JDQ39) AppleWebKit/535.19 (KHTML, like Gecko) Version/1.0 Chrome/18.0.1025.308 Mobile Safari/535.19127
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11127

Port report

Port report

Loading