Loading threats
SMTP client issued the HELO command to initiate a legacy SMTP session. Unlike EHLO, this greeting does not request or negotiate extended SMTP capabilities and typically indicates a minimal or compatibility-focused client. In honeypot telemetry, HELO is commonly seen in basic probes, older tooling, or lightweight automation that performs simple connectivity or relay checks without extension discovery.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 91.92.240.214 | 90% | 894 | 890 | 🇩🇪 DE | AS202412 | 2026-04-19 |
| 158.94.209.131 | 100% | 812 | 730 | 🇳🇱 NL | AS202412 | 2026-04-09 |
| 79.124.49.226 | 67% | 691 | 389 | 🇧🇬 BG | AS50360 | 2026-02-23 |
| 119.160.166.237 | 76% | 635 | 370 | 🇧🇳 BN | AS10094 | 2026-04-19 |
| 41.231.85.75 | 79% | 634 | 368 | 🇹🇳 TN | AS37705 | 2026-04-19 |
| 130.185.96.113 | 63% | 489 | 305 | 🇮🇱 IL | AS16116 | 2026-04-18 |
| 158.94.211.35 | 98% | 427 | 106 | 🇺🇸 US | AS202412 | 2026-03-20 |
| 50.6.250.242 | 98% | 419 | 93 | 🇺🇸 US | AS31898 | 2026-02-20 |
| 146.70.146.50 | 97% | 372 | 145 | 🇦🇹 AT | AS9009 | 2026-03-26 |
| 158.94.210.111 | 95% | 348 | 56 | 🇳🇱 NL | AS202412 | 2026-04-16 |
| 64.89.163.23 | 99% | 323 | 214 | 🇬🇧 GB | AS401626 | 2026-04-17 |
| 45.144.212.177 | 75% | 300 | 59 | 🇺🇦 UA | AS214940 | 2026-04-17 |
| 83.142.209.12 | 87% | 282 | 282 | 🇳🇱 NL | AS205759 | 2026-03-24 |
| 158.94.210.190 | 90% | 275 | 111 | 🇳🇱 NL | AS202412 | 2026-04-19 |
| 80.87.206.253 | 99% | 260 | 260 | 🇷🇺 RU | AS16276 | 2026-04-10 |
| 178.16.53.31 | 84% | 162 | 32 | 🇳🇱 NL | AS202412 | 2026-04-13 |
| 185.169.4.204 | 90% | 149 | 149 | 🇬🇧 GB | AS209605 | 2026-03-06 |
| 158.94.210.42 | 87% | 133 | 19 | 🇳🇱 NL | AS202412 | 2026-03-03 |
| 158.94.211.111 | 78% | 132 | 25 | 🇺🇸 US | AS202412 | 2026-02-24 |
| 160.30.136.17 | 96% | 128 | 79 | 🇻🇳 VN | AS150895 | 2026-04-11 |