HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq030_00810800_7e369cbb

Seen 2026-02-21 to 2026-09-28 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS135377 sends an email when it next hits a sensor.

75

Source IPs

6

Networks

4

Countries

6

Ports hit

99

Events

12

IPs / network

Top networks

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED27 IPs39
AS9465 AGOTOZ PTE. LTD.25 IPs36
AS4808 China Unicom Beijing Province Network9 IPs10
AS4837 CHINA UNICOM China169 Backbone9 IPs9
AS4134 Chinanet4 IPs4
AS17621 China Unicom Shanghai network1 IPs1

Countries

HK 50CN 23SG 1US 1

Ports targeted

49152/tcp 2849155/tcp 2449153/tcp 2249154/tcp 1949151/tcp 51900/tcp 1

What it requests

POSThttp://<HONEYPOT>:49152/upnp/control/basicevent127
POSThttp://<HONEYPOT>:49155/upnp/control/basicevent124
POSThttp://<HONEYPOT>:49153/upnp/control/basicevent122
POSThttp://<HONEYPOT>:49154/upnp/control/basicevent119
POSThttp://<HONEYPOT>:49151/upnp/control/basicevent15
POSThttp://39.119.25.149:49152/upnp/control/basicevent11
POSThttp://<HONEYPOT>:1900/upnp/control/basicevent11
Source IPCCNetwork Last seenEvents
128.1.132.84HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-153
156.225.1.102HKAS9465 AGOTOZ PTE. LTD.2026-09-243
118.193.38.163HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-243
156.225.1.111HKAS9465 AGOTOZ PTE. LTD.2026-09-243
156.225.1.91HKAS9465 AGOTOZ PTE. LTD.2026-09-232
156.225.1.116HKAS9465 AGOTOZ PTE. LTD.2026-09-142
106.75.3.148CNAS4808 China Unicom Beijing Province Network2026-09-132
156.225.1.31HKAS9465 AGOTOZ PTE. LTD.2026-09-232
103.210.21.36SGAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-252
45.249.245.173HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-232
123.58.210.134HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-232
123.58.219.233HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-052
156.225.1.112HKAS9465 AGOTOZ PTE. LTD.2026-09-242
152.32.254.132HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-232
123.58.217.155HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-052
156.225.1.90HKAS9465 AGOTOZ PTE. LTD.2026-09-242
152.32.213.13HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-152
156.225.1.94HKAS9465 AGOTOZ PTE. LTD.2026-09-242
156.225.1.35HKAS9465 AGOTOZ PTE. LTD.2026-09-152
152.32.133.206HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-252

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b10cuq030_00810800_e62b6d85same header set2 IPs4b10cuq030_00810800_7e369cbbsame header set1 IPs1b10cuq040_00850800_a31e7c351 header apart28 IPs28b10cuq020_00010800_724c10fb1 header apart1 IPs1b11cuq030_00050800_e62b6d852 headers apart197 IPs552b11cuq050_00850810_800b45672 headers apart46 IPs47b11cuq050_00850801_985b94972 headers apart3 IPs11b11cun030_00810010_e62b6d852 headers apart2 IPs7

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.