HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a10cun020_00000041_0a8d7f11

Seen 2026-09-22 to 2026-09-23 across the retained window.

Open in lookup →

1.4K

Source IPs

5

Networks

5

Countries

7.4K

Ports hit

9.2K

Events

286

IPs / network

Top networks

AS396982 Google LLC1.4K IPs9.2K
AS202425 IP Volume inc3 IPs20
AS214664 JSC F62 IPs7
AS34665 Petersburg Internet Network ltd.2 IPs4
AS197834 Ucom CJSC1 IPs2

Countries

US 926GB 498RU 4NL 3AM 1

Ports targeted

80/tcp 2263090/tcp 456178/tcp 451231/tcp 455499/tcp 427422/tcp 419037/tcp 432877/tcp 48637/tcp 433870/tcp 434904/tcp 452848/tcp 4

What it requests

GET/9.2K

User agents claimed

Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity1.4K IPs9.2K
Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)4 IPs15
Mozilla/5.0 (Linux; Android 6.0.1; SM-N910S) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.361 IPs5
Mozilla/5.0 (Linux; Android 9; G8141) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.361 IPs4
Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.4(0x17000428) NetType/WIFI Language/zh_CN1 IPs3
Source IPCCNetwork Last seenEvents
162.216.150.88USAS396982 Google LLC2026-09-2319
162.216.149.90USAS396982 Google LLC2026-09-2318
35.203.210.193GBAS396982 Google LLC2026-09-2317
162.216.149.77USAS396982 Google LLC2026-09-2316
162.216.150.95USAS396982 Google LLC2026-09-2315
147.185.133.90USAS396982 Google LLC2026-09-2315
147.185.133.15USAS396982 Google LLC2026-09-2315
35.203.210.105GBAS396982 Google LLC2026-09-2314
35.203.210.4GBAS396982 Google LLC2026-09-2314
35.203.210.33GBAS396982 Google LLC2026-09-2314
147.185.132.232USAS396982 Google LLC2026-09-2314
162.216.149.3USAS396982 Google LLC2026-09-2314
35.203.211.32GBAS396982 Google LLC2026-09-2314
162.216.149.158USAS396982 Google LLC2026-09-2314
162.216.149.108USAS396982 Google LLC2026-09-2314
162.216.150.144USAS396982 Google LLC2026-09-2314
162.216.150.129USAS396982 Google LLC2026-09-2314
162.216.150.103USAS396982 Google LLC2026-09-2313
35.203.211.150GBAS396982 Google LLC2026-09-2313
147.185.132.128USAS396982 Google LLC2026-09-2313

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun020_00000041_0a8d7f11same header set5 IPs5a11cun030_00000049_03330a181 header apart2 IPs14.0Ka11cun030_00000049_54d07b6d1 header apart544 IPs1.1Ka10cun010_00000001_a37af9cb1 header apart5 IPs17a10cun030_00000049_54d07b6d1 header apart3 IPs6a10cun041_00000049_8cf638c81 header apart1 IPs3a11cun030_00000045_6396c54d1 header apart1 IPs1a11cun040_0000004d_aa48e2c82 headers apart1.3K IPs9.1K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.