AS55990: Huawei Cloud Service data center
HoneyLabs honeypots recorded 392 probes from AS55990 (Huawei Cloud Service data center) in the last 7 days, originating from 11 distinct source IP addresses.
First observed 2026-11-06 14:48, most recently 2026-11-13 04:09 (UTC).
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-10, with 243. Its 11 addresses probed 23 distinct ports. The most probed was port 443, with 13% of the probes. One address, 121.36.245.197, sent 88% of them. None of the 11 busiest addresses is a recognised research scanner.
Ports it targets
| Port | Probes |
|---|---|
| 443 | 51 |
| 80 | 49 |
| 8080 | 46 |
| 8443 | 46 |
| 8880 | 46 |
| 2087 | 24 |
| 2053 | 23 |
| 2096 | 23 |
Most active source addresses
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 121.36.245.197 | 346 | China | |
| 115.175.228.203 | 16 | China | |
| 139.159.157.238 | 9 | China | |
| 113.44.211.208 | 4 | China | |
| 116.204.96.214 | 3 | China | |
| 1.94.33.73 | 3 | China | |
| 1.95.76.8 | 3 | China | |
| 113.45.39.25 | 3 | China |
Where it comes from
| Country | Probes |
|---|---|
| China | 392 |
Client strings it sends
| User agent | Probes |
|---|---|
| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | 346 |
| Mozilla/5.0 (Linux; Android 16; Pixel 9 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.93 Mobile Safari/537.36 | 9 |
| Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/8.0.42 | 6 |
| go-dockerclient | 3 |
ASN report
ASN report
Loading