HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun060_0000005f_fc0644f8

Seen 2026-09-25 to 2026-09-26 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS37963 sends an email when it next hits a sensor.

152

Source IPs

1

Networks

1

Countries

164

Ports hit

338

Events

152

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS37963 Hangzhou Alibaba Advertising Co.,Ltd.152 IPs338

Countries

CN 152

Ports targeted

56379/tcp 550001/tcp 512200/tcp 451005/tcp 41024/tcp 48003/tcp 44222/tcp 42091/tcp 349672/tcp 38983/tcp 3446/tcp 38880/tcp 3

What it requests

GET/196
GET/favicon.ico142

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36152 IPs338
Source IPCCNetwork Last seenEvents
39.100.86.191CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-266
47.95.199.236CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-265
47.95.205.12CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-265
47.95.209.9CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
47.95.198.252CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
39.100.84.119CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
39.100.86.140CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
39.100.77.193CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
47.94.138.70CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
39.100.85.23CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
121.43.54.111CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
47.95.210.228CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
112.124.56.43CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
47.97.111.180CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-264
121.43.117.235CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-263
47.95.197.5CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-263
47.95.202.163CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-263
118.31.189.46CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-263
121.41.164.122CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-253
47.95.209.135CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-263

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun060_0000005f_d170ef01same header set7 IPs6.3Ka11cun060_0000005f_521e1e4esame header set1 IPs1.6Ka11cun060_0000005f_720361ccsame header set2 IPs999a11cun060_0000005f_7d5e642bsame header set179 IPs940a11cun060_0000005f_3e751395same header set128 IPs354a11cun060_0000005f_2ef3966dsame header set1 IPs346a11cun060_0000005f_4dbae000same header set17 IPs229a11cun060_0000005f_a83fa1e6same header set1 IPs63

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.