Loading threats
SMTP client issued an EHLO command to identify itself and initiate an Extended SMTP session. This is the standard capability negotiation step where the client announces its hostname and requests supported extensions from the server. On exposed or honeypot SMTP services, automated tools and spam bots often send EHLO immediately after connecting as part of relay testing, enumeration, or bulk delivery workflows.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 154.83.15.73 | 97% | 114,863 | 1,091 | 🇭🇰 HK | AS142403 | 2026-02-05 |
| 109.122.18.73 | 99% | 111,472 | 1,059 | 🇺🇸 US | AS22439 | 2026-02-06 |
| 194.26.192.102 | 91% | 54,308 | 11,426 | 🇳🇱 NL | AS210558 | 2026-03-02 |
| 81.29.142.100 | 100% | 20,831 | 11,697 | 🇷🇺 RU | AS210259 | 2026-03-02 |
| 81.29.142.6 | 99% | 13,985 | 8,279 | 🇷🇺 RU | AS210259 | 2026-03-02 |
| 45.91.64.6 | 100% | 13,848 | 7,469 | 🇷🇺 RU | AS214664 | 2026-03-03 |
| 80.94.93.5 | 98% | 11,256 | 11,232 | 🇷🇴 RO | AS47890 | 2026-03-01 |
| 95.215.0.144 | 97% | 7,717 | 4,563 | 🇷🇺 RU | AS44050 | 2026-03-03 |
| 207.90.244.28 | 100% | 6,625 | 3,751 | 🇺🇸 US | AS174 | 2026-03-03 |
| 185.242.226.19 | 88% | 5,510 | 2,294 | 🇺🇸 US | AS202425 | 2026-03-02 |
| 207.90.244.14 | 100% | 5,322 | 3,169 | 🇺🇸 US | AS174 | 2026-03-03 |
| 155.117.232.31 | 88% | 5,087 | 3,163 | 🇺🇸 US | AS399486 | 2026-02-24 |
| 115.231.78.11 | 98% | 4,937 | 2,758 | 🇨🇳 CN | AS58461 | 2026-03-03 |
| 80.13.153.140 | 99% | 4,091 | 2,270 | 🇫🇷 FR | AS3215 | 2026-03-03 |
| 80.82.77.202 | 96% | 4,035 | 2,835 | 🇳🇱 NL | AS202425 | 2026-03-03 |
| 92.154.95.236 | 99% | 3,629 | 1,984 | 🇫🇷 FR | AS3215 | 2026-03-03 |
| 45.91.64.7 | 98% | 3,456 | 2,367 | 🇷🇺 RU | AS214664 | 2026-03-03 |
| 71.6.199.23 | 100% | 3,331 | 1,563 | 🇺🇸 US | AS10439 | 2026-03-03 |
| 185.93.89.18 | 95% | 3,105 | 3,094 | 🇮🇷 IR | AS213790 | 2026-03-03 |
| 59.188.128.151 | 74% | 3,025 | 768 | 🇭🇰 HK | AS9269 | 2026-02-27 |