HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun030_0000004c_13ee3d34

Seen 2026-09-22 to 2026-09-23 across the retained window.

Open in lookup →

1.7K

Source IPs

14

Networks

7

Countries

2.6K

Ports hit

4.0K

Events

123

IPs / network

Top networks

AS396982 Google LLC1.6K IPs3.3K
AS45102 Alibaba (US) Technology Co., Ltd.89 IPs463
AS16509 Amazon.com, Inc.16 IPs19
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED15 IPs22
AS14061 DigitalOcean, LLC10 IPs32
AS212512 Detai Prosperous Technologies Limited8 IPs141
AS63949 Akamai Connected Cloud6 IPs6
AS219502 Storm Industries LLC3 IPs33
AS205196 Big Core LLC2 IPs5
AS51396 Pfcloud UG (haftungsbeschrankt)1 IPs3
AS20278 Nexeon Technologies, Inc.1 IPs2
AS398324 Censys, Inc.1 IPs1

Countries

US 1.1KGB 399SG 89BE 83DE 14NL 3TR 2

Ports targeted

8080/tcp 5221/tcp 1223/tcp 12143/tcp 12110/tcp 1280/tcp 118090/tcp 104433/tcp 102083/tcp 92087/tcp 88088/tcp 810250/tcp 8

What it requests

GET/3.5K
GET/favicon.ico485
GET/login40
GET/query?q=show+databases%3Bshow+diagnostics+for+%27runtime%27%3Bshow+diagnostics+for+%27network%27%3Bshow+stats+for+%27shard%27%3Bshow+stats+for+%27runtime%27%3Bshow+users%3Bshow+diagnostics+for+%27system%274
GET/login/2
GET/enhancecp2
GET/nodeworx/index2
GET/robots.txt2
GET/index.php?act=login2
GET/geoserver/wfs?request=ListStoredQueries&service=wfs&version=2.0.02
GET/version1
GET/login_up.php1

User agents claimed

Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity1.5K IPs3.2K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3691 IPs466
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.3683 IPs146
Go-http-client/1.113 IPs69
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.3617 IPs24
Source IPCCNetwork Last seenEvents
45.82.78.104DEAS212512 Detai Prosperous Technologies Limited2026-09-2323
45.82.78.105DEAS212512 Detai Prosperous Technologies Limited2026-09-2321
45.82.78.100DEAS212512 Detai Prosperous Technologies Limited2026-09-2320
45.82.78.102DEAS212512 Detai Prosperous Technologies Limited2026-09-2319
45.82.78.108DEAS212512 Detai Prosperous Technologies Limited2026-09-2316
94.154.43.223NLAS219502 Storm Industries LLC2026-09-2316
43.106.58.188SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2316
94.154.43.254NLAS219502 Storm Industries LLC2026-09-2315
45.82.78.103DEAS212512 Detai Prosperous Technologies Limited2026-09-2315
45.82.78.107DEAS212512 Detai Prosperous Technologies Limited2026-09-2314
43.106.52.96SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2313
43.106.48.6SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2313
45.82.78.106DEAS212512 Detai Prosperous Technologies Limited2026-09-2313
43.98.200.1SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2311
47.84.96.224SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2311
43.106.56.76SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2311
43.106.52.37SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2311
43.106.58.146SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2311
47.84.97.178SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2310
47.84.111.144SGAS45102 Alibaba (US) Technology Co., Ltd.2026-09-2310

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun040_0000004d_aa48e2c81 header apart1.4K IPs9.5Ka11cun040_0000004e_608dab681 header apart443 IPs5.5Ka11cun040_0000004d_4110f1561 header apart10 IPs3.0Ka11cun020_00000048_724c10fb1 header apart83 IPs473a11cun040_0000004e_36fbce141 header apart296 IPs334a11cun040_0000004d_c2bd490f1 header apart29 IPs235a11cun040_0000004d_f36dd82e1 header apart6 IPs160a11cun064_00000048_f2f3ae251 header apart2 IPs85

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.