HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun050_000000cd_6289c865

Seen 2026-09-23 to 2026-09-23 across the retained window.

Open in lookup →

1

Source IPs

1

Networks

1

Countries

1

Ports hit

11.6K

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS213790 Limited Network LTD1 IPs11.6K

Countries

NL 1

Ports targeted

1723/tcp 11.6K

What it requests

GET/.env/.gcloud/credentials.json;;2
GET/.env/_oi1359maqklq%EF%BF%BD2
GET/.aws/config.properties%EF%BF%BD2
GET/.aws/developmentserver/metadatauploader;2
GET/cmd/testdata/expected/dot_env/.env2
GET/.env/pages/templates2/viewpagetemplate.action%EF%BF%BD2
GET/.env/.settings.local.json2
GET/.env/.env.test%EF%BF%BD;2
GET/.env/.htpasswd%EF%BF%BD%EF%BF%BD2
GET/.aws/livewire/update%EF%BF%BD2
GET/.claude/.settings.local.txt;2
GET/server/ses_credentials.json2

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.01 IPs1.5K
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.151 IPs1.5K
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.361 IPs1.5K
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.01 IPs1.5K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.361 IPs1.4K
Source IPCCNetwork Last seenEvents
192.253.248.173AS0 Limited Network LTD2026-09-2311.6K

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun040_0000004d_aa48e2c81 header apart1.7K IPs22.7Ka11cun040_0000004d_4110f1561 header apart10 IPs5.0Ka11cun040_0000004d_c2bd490f1 header apart33 IPs395a11cun040_0000004d_f36dd82e1 header apart8 IPs250a11cun040_0000004d_c5bb04c51 header apart9 IPs232a11cun051_0000004d_a7cb51b41 header apart1 IPs12a11cun051_0000004d_6289c8651 header apart7 IPs7a11cun040_0000004d_1d05953d1 header apart2 IPs7

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.