HoneyLabs

Akin HTTP request fingerprint

a11cun040_0000004b_a4cdfabf

Seen 2026-09-23 to 2026-09-23 across the retained window.

2

Source IPs

2

Networks

2

Countries

3

Ports hit

10

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

Countries

RU 1BG 1

Ports targeted

What it requests

GET/6

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64)1 IPs6
Mozilla/5.0 SynologyDetect/1.01 IPs4
Source IPCCNetwork Last seenEvents
5.188.206.122BGAS200391 Krez 999 Eood2026-09-236
77.91.71.90RUAS211486 Alferov Aleksey Aleksandrovich2026-09-234

Fingerprint family: 2 shapes, 58 IPs, 175 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 3 headers, no body: connection, host, user-agent

asks for/ · /solr/admin/cores?action=STATUS&wt=json · /cgi-bin/authLogin.cgi · /solr/admin/info/system (GET)
asGo-http-client/1.1 · WanScannerBot/1.0 · Mozilla/5.0 and 12 more
ports5060 · 27017 · 8087 · 9202
fromUS · DE · NL · SG · DigitalOcean, LLC · Storm Industries LLC · GSL Networks Pty LTD
a11cun030_0000004a_c91eaf54Go-http-client/1.1 · /58 IPs165a11cun040_0000004b_a4cdfabf this one+/- accept · Mozilla/5.0 (Windows NT 10.0; Win64; x64) · /2 IPs10

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun040_0000004b_4c87b06esame header set113 IPs509a11cun040_0000004b_00b09b79same header set1 IPs173a11cun040_0000004b_ba182931same header set3 IPs24a10cun040_0000004b_4c87b06esame header set2 IPs16a11cun051_0000004b_df66fe0fsame header set3 IPs3a11cun040_0000004b_469eb43fsame header set2 IPs3a11cun030_00000049_03330a181 header apart2 IPs15.3Ka11cun050_0000005b_09001b3e1 header apart966 IPs4.7K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.