HoneyLabs

Akin HTTP request fingerprint

a11cun040_0000044a_bf8a4cbb

Seen 2026-09-23 to 2026-09-23 across the retained window.

3

Source IPs

1

Networks

3

Countries

1

Ports hit

24

Events

3

IPs / network

Top networks

Countries

GB 1US 1JP 1

Ports targeted

What it requests

User agents claimed

Go-http-client/1.13 IPs24
Source IPCCNetwork Last seenEvents
47.89.154.16USAS45102 Alibaba (US) Technology Co., Ltd.2026-09-238
8.208.10.94GBAS45102 Alibaba (US) Technology Co., Ltd.2026-09-238
8.211.162.45JPAS45102 Alibaba (US) Technology Co., Ltd.2026-09-238

Fingerprint family: 2 shapes, 3 IPs, 48 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 4 headers, no body: connection, host, user-agent, content-type

asks for/dns-query?dns=ggkBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDd · /dns-query · /dns-query?dns=4-UBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDd · /resolve (GET / POST)
asGo-http-client/1.1 and 1 more
ports443
fromJP · GB · US · Alibaba (US) Technology Co., Ltd.
a11cun040_0000044a_bf8a4cbb this oneGo-http-client/1.1 · /dns-query?dns=4-UBAAABAAAAAAAAATEEb2RucwFtCmRuc21lYXN1cmUDd3 IPs24a11cuq050_0000064a_9b8c433a+/- content-length · Go-http-client/1.1 · /resolve3 IPs24

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun030_0000004a_c91eaf541 header apart58 IPs165a11cuq050_0000064a_9b8c433a1 header apart3 IPs24a11cuq061_0000064a_ffe601071 header apart13 IPs19a10cun030_0000004a_c91eaf541 header apart1 IPs1a11cun040_0000004e_608dab682 headers apart449 IPs5.8Ka11cun020_00000048_724c10fb2 headers apart96 IPs532a11cun040_0000004b_4c87b06e2 headers apart113 IPs509a10cun020_0000000a_78f1f19c2 headers apart100 IPs452

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.