HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cdn100_0000117f_d2149c4c

Seen 2026-09-22 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS132203 sends an email when it next hits a sensor.

60

Source IPs

1

Networks

9

Countries

2

Ports hit

65

Events

60

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS132203 Tencent Building, Kejizhongyi Avenue60 IPs65

Countries

US 25SG 10DE 7BR 5KR 4HK 3TH 3JP 2ID 1

Ports targeted

80/tcp 50443/tcp 15

What it requests

GET/64
GET/cgi-bin/login.cgi1

User agents claimed

Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.160 IPs65
Source IPCCNetwork Last seenEvents
162.62.231.139AS0 Tencent Building, Kejizhongyi Avenue2026-09-242
43.161.224.78AS0 Tencent Building, Kejizhongyi Avenue2026-09-232
43.157.150.69AS0 Tencent Building, Kejizhongyi Avenue2026-09-242
43.157.170.126AS0 Tencent Building, Kejizhongyi Avenue2026-09-232
43.157.191.20AS0 Tencent Building, Kejizhongyi Avenue2026-09-242
43.130.105.21AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
49.51.132.100AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
43.165.65.117AS0 Tencent Building, Kejizhongyi Avenue2026-09-241
101.33.80.42AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
43.165.167.69AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
43.159.152.187AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
43.163.112.239AS0 Tencent Building, Kejizhongyi Avenue2026-09-221
43.167.245.18AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
170.106.65.93AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
43.173.123.22AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
49.51.204.74AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
43.159.34.167AS0 Tencent Building, Kejizhongyi Avenue2026-09-241
43.130.141.193AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
43.130.102.223AS0 Tencent Building, Kejizhongyi Avenue2026-09-231
150.109.230.210AS0 Tencent Building, Kejizhongyi Avenue2026-09-221

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun090_0000117f_92d63670same header set1 IPs1a11cun080_0000115f_2f0041701 header apart356 IPs469a11cun080_0000117b_95095a1a1 header apart2 IPs339a11cun080_0000116f_56e7a0bf1 header apart3 IPs15a11cun091_0000017f_0f98df941 header apart1 IPs1a11cun070_0000007f_24ed61c52 headers apart3 IPs3a11cun070_0000015f_db7c09db2 headers apart1 IPs3a11cun070_0000007f_9030c7a22 headers apart1 IPs2

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.