HoneyLabs

Akin HTTP request fingerprint

a11cun031_00000048_e62b6d85

Seen 2026-09-22 to 2026-09-23 across the retained window.

2

Source IPs

1

Networks

1

Countries

95

Ports hit

95

Events

2

IPs / network

Top networks

Countries

DE 2

Ports targeted

What it requests

User agents claimed

ncsrv2 IPs95
Source IPCCNetwork Last seenEvents
94.26.83.79DEAS207043 Dedik Services Limited2026-09-2350
91.92.43.222DEAS207043 Dedik Services Limited2026-09-2345

Fingerprint family: 4 shapes, 95 IPs, 817 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 2 headers, no body: host, user-agent

asks for/ · /my.policy · /myvpn?sess=none&hdlc_framing=no&ipv4=1&ipv6=1&Z=none&hostna · /vpntunnel (GET / HEAD)
aswhat-vpn-go/0.1 · fasthttp · Hello from Palo Alto Networks, find out more about our scans in https://docs-cor and 75 more
ports443 · 8080 · 15500 · 8090
fromDE · US · RU · NL · Dedik Services Limited · Hurricane Electric LLC · JSC F6
a11cun020_00000048_724c10fbwhat-vpn-go/0.1 · /95 IPs531a11cuq030_00000248_e62b6d85+/- content-length · what-vpn-go/0.1 · /clients3 IPs96a11cun031_00000048_e62b6d85 this onencsrv · /dana-na2 IPs95a11cun064_00000048_f2f3ae25what-vpn-go/0.1 · /sslvpnclient?launchplatform=mac&neProto=3&supportipv6=yes2 IPs95

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun020_00000048_724c10fbsame header set96 IPs532a11cun064_00000048_f2f3ae25same header set2 IPs95a10cun020_00000048_724c10fbsame header set2 IPs16a11cun030_00000049_03330a181 header apart2 IPs15.3Ka11cun030_0000004c_13ee3d341 header apart1.7K IPs4.1Ka11cun010_00000008_c4b2c4aa1 header apart332 IPs1.5Ka11cun030_00000049_54d07b6d1 header apart581 IPs1.2Ka11cun030_0000004a_c91eaf541 header apart58 IPs165

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.