HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq070_00440817_81cd6514

Seen 2026-02-28 to 2026-09-28 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS135377 sends an email when it next hits a sensor.

10

Source IPs

2

Networks

7

Countries

1

Ports hit

11

Events

5

IPs / network

Top networks

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED9 IPs10
AS136907 HUAWEI CLOUDS1 IPs1

Countries

TH 4JP 1GB 1KR 1HK 1ZA 1TW 1

Ports targeted

5985/tcp 11

What it requests

POST/wsman11

User agents claimed

Mozilla/5.0 (iPad; CPU iPad OS 9_3_6 like Mac OS X) AppleWebKit/532.2 (KHTML, like Gecko) CriOS/19.0.889.0 Mobile/45U796 Safari/532.21 IPs2
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_11_9; rv:1.9.2.20) Gecko/8887-06-22 02:52:53.112427 Firefox/11.01 IPs1
Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_7_7) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/57.0.866.0 Safari/533.21 IPs1
Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/532.37.1 (KHTML, like Gecko) Version/4.0.4 Safari/532.37.11 IPs1
Mozilla/5.0 (iPad; CPU iPad OS 12_5_7 like Mac OS X) AppleWebKit/536.0 (KHTML, like Gecko) FxiOS/17.7t9768.0 Mobile/77G100 Safari/536.01 IPs1
Source IPCCNetwork Last seenEvents
152.32.146.166JPAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-282
165.154.119.52THAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-191
165.154.120.2THAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-281
121.91.156.70ZAAS136907 HUAWEI CLOUDS2026-09-191
165.154.51.243THAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-101
101.36.114.4KRAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-281
165.154.128.17GBAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-101
118.193.56.184THAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-101
152.32.128.149HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-101
152.32.165.241TWAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-191

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq060_00040817_a9482ae21 header apart70 IPs78b11cun060_00440017_db4702471 header apart3 IPs42b11cuq080_00450817_12e4ce341 header apart4 IPs35b11cuq060_00040817_8e5e346c1 header apart4 IPs19b11cuq060_00040817_1d4645401 header apart2 IPs9b11cun060_00440017_1d4645401 header apart3 IPs6b11cuq060_00440813_95cc9d021 header apart2 IPs5b11cuq080_00450817_cb8d62e51 header apart4 IPs4

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.