HoneyLabs

Akin HTTP request fingerprint

a11cun040_0000004d_c2bd490f

Seen 2026-09-22 to 2026-09-23 across the retained window.

29

Source IPs

5

Networks

4

Countries

138

Ports hit

235

Events

6

IPs / network

Top networks

Countries

US 18GB 6CA 6NL 5

Ports targeted

What it requests

GET/235

User agents claimed

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.3628 IPs199
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.3611 IPs36
Source IPCCNetwork Last seenEvents
86.54.31.44GBAS12989 Black HOST Ltd2026-09-2322
207.90.244.6USAS174 Cogent Communications, LLC2026-09-2319
71.6.199.23USAS10439 CariNet, Inc.2026-09-2318
207.90.244.4USAS174 Cogent Communications, LLC2026-09-2316
207.90.244.28USAS174 Cogent Communications, LLC2026-09-2315
207.90.244.18USAS174 Cogent Communications, LLC2026-09-2314
207.90.244.12USAS174 Cogent Communications, LLC2026-09-2313
86.54.31.32GBAS12989 Black HOST Ltd2026-09-2312
207.90.244.19USAS174 Cogent Communications, LLC2026-09-2311
207.90.244.17USAS174 Cogent Communications, LLC2026-09-2310
86.54.31.36GBAS12989 Black HOST Ltd2026-09-239
207.90.244.26USAS174 Cogent Communications, LLC2026-09-238
93.174.95.106NLAS202425 IP Volume inc2026-09-238
71.6.165.200USAS10439 CariNet, Inc.2026-09-238
80.82.77.33NLAS202425 IP Volume inc2026-09-237
86.54.31.38GBAS12989 Black HOST Ltd2026-09-237
71.6.147.254USAS10439 CariNet, Inc.2026-09-236
71.6.135.131USAS10439 CariNet, Inc.2026-09-234
80.82.77.139NLAS202425 IP Volume inc2026-09-234
71.6.158.166USAS10439 CariNet, Inc.2026-09-234

Fingerprint family: 2 shapes, 29 IPs, 472 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

a11cun050_0000004f_af92465929 IPs238a11cun040_0000004d_c2bd490f this one29 IPs234

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun040_0000004d_aa48e2c8same header set1.4K IPs9.5Ka11cun040_0000004d_4110f156same header set10 IPs3.0Ka11cun040_0000004d_f36dd82esame header set6 IPs160a11cun040_0000004d_c5bb04c5same header set3 IPs70a11cun051_0000004d_a7cb51b4same header set1 IPs12a11cun051_0000004d_6289c865same header set6 IPs6a11cun062_0000004d_c61c0cf4same header set1 IPs4a11cun040_0000004d_50f90888same header set2 IPs2

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.