Loading threats
SMTP client issued the HELO command to initiate a legacy SMTP session. Unlike EHLO, this greeting does not request or negotiate extended SMTP capabilities and typically indicates a minimal or compatibility-focused client. In honeypot telemetry, HELO is commonly seen in basic probes, older tooling, or lightweight automation that performs simple connectivity or relay checks without extension discovery.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 79.124.49.226 | 67% | 691 | 389 | 🇧🇬 BG | AS50360 | 2026-02-23 |
| 119.160.166.237 | 77% | 546 | 283 | 🇧🇳 BN | AS10094 | 2026-03-05 |
| 41.231.85.75 | 81% | 506 | 240 | 🇹🇳 TN | AS37705 | 2026-03-05 |
| 50.6.249.246 | 94% | 453 | 85 | 🇺🇸 US | AS31898 | 2026-02-06 |
| 50.6.250.242 | 98% | 419 | 93 | 🇺🇸 US | AS31898 | 2026-02-20 |
| 130.185.96.113 | 67% | 403 | 221 | 🇮🇱 IL | AS16116 | 2026-03-05 |
| 158.94.211.35 | 95% | 396 | 75 | 🇺🇸 US | AS202412 | 2026-03-04 |
| 146.70.146.50 | 97% | 352 | 125 | 🇦🇹 AT | AS9009 | 2026-03-05 |
| 158.94.210.111 | 89% | 315 | 23 | 🇳🇱 NL | AS202412 | 2026-03-05 |
| 50.6.227.37 | 98% | 312 | 56 | 🇺🇸 US | AS31898 | 2026-02-08 |
| 64.89.163.23 | 98% | 249 | 140 | 🇬🇧 GB | AS401626 | 2026-03-03 |
| 91.92.240.214 | 74% | 161 | 160 | 🇩🇪 DE | AS202412 | 2026-03-05 |
| 158.94.210.42 | 87% | 133 | 19 | 🇳🇱 NL | AS202412 | 2026-03-03 |
| 158.94.211.111 | 78% | 132 | 25 | 🇺🇸 US | AS202412 | 2026-02-24 |
| 185.169.4.166 | 55% | 119 | 52 | 🇬🇧 GB | AS209605 | 2026-02-15 |
| 158.94.210.133 | 88% | 113 | 29 | 🇳🇱 NL | AS202412 | 2026-03-04 |
| 77.83.39.43 | 86% | 107 | 44 | 🇺🇦 UA | AS214940 | 2026-03-03 |
| 158.94.210.212 | 81% | 98 | 18 | 🇳🇱 NL | AS202412 | 2026-03-03 |
| 185.169.4.167 | 58% | 91 | 42 | 🇬🇧 GB | AS209605 | 2026-03-02 |
| 193.56.116.250 | 74% | 87 | 2 | 🇺🇸 US | AS62240 | 2026-02-06 |