HoneyLabs

Akin HTTP request fingerprint

a10cun020_00000048_724c10fb

Seen 2026-09-22 to 2026-09-23 across the retained window.

2

Source IPs

2

Networks

2

Countries

8

Ports hit

16

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

Countries

NL 1DE 1

Ports targeted

What it requests

GET/16

User agents claimed

0day1 IPs15
Mozilla/5.01 IPs1
Source IPCCNetwork Last seenEvents
45.135.193.198DEAS51396 Pfcloud UG (haftungsbeschrankt)2026-09-2315
46.151.178.133NLAS211443 Sino Worldwide Trading Limited2026-09-221

Fingerprint family: 2 shapes, 3 IPs, 22 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.0, 3 headers, no body: accept, host, user-agent

asks for/ · /admin/config.php (GET)
as0day · Mozilla/5.0 · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 and 1 more
ports8088 · 8080 · 5038 · 18088
fromDE · NL · AZ · BR · Pfcloud UG (haftungsbeschrankt) · Sino Worldwide Trading Limited · az-evro Tel LLC
a10cun030_00000049_54d07b6dMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 · /admin/config.php3 IPs6a10cun020_00000048_724c10fb this one+/- accept · 0day · /2 IPs16

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun020_00000048_724c10fbsame header set96 IPs532a11cun064_00000048_f2f3ae25same header set2 IPs95a11cun031_00000048_e62b6d85same header set2 IPs95a11cun030_00000049_03330a181 header apart2 IPs15.3Ka11cun030_0000004c_13ee3d341 header apart1.7K IPs4.1Ka11cun010_00000008_c4b2c4aa1 header apart332 IPs1.5Ka11cun030_00000049_54d07b6d1 header apart581 IPs1.2Ka11cun030_0000004a_c91eaf541 header apart58 IPs165

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.