HoneyLabs

Akin HTTP request fingerprint

a11cun060_0000007b_f55b17ef

Seen 2026-09-22 to 2026-09-23 across the retained window.

2

Source IPs

2

Networks

2

Countries

4

Ports hit

3.4K

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

Countries

RO 1DE 1

Ports targeted

What it requests

User agents claimed

Mozilla/5.0 (Linux; Android 6.0.1; SM-G550T1 Build/MMB29K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.132 Mobile Safari/537.361 IPs328
Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.361 IPs328
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0; yie10)1 IPs328
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.01 IPs327
Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.4) Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty)1 IPs297
Source IPCCNetwork Last seenEvents
213.209.159.175DEAS208137 Feo Prest SRL2026-09-231.8K
80.94.95.211ROAS204428 SS-Net2026-09-231.6K

Fingerprint family: 3 shapes, 2 IPs, 3.5K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

a11cun060_0000007b_f55b17ef this one2 IPs3.4Ka11cun050_00000079_a47bb3dc2 IPs13a11cun060_0000007b_8084a0272 IPs13

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun060_0000007b_8084a027same header set2 IPs13a11cun050_0000005b_09001b3e1 header apart963 IPs4.4Ka11cun050_0000005b_e6fe1ac31 header apart1 IPs266a11cun050_0000005b_fda4f7dc1 header apart1 IPs146a11cun050_0000006b_bd5c72d11 header apart8 IPs22a11cun050_0000006b_6e36c7cb1 header apart4 IPs17a11cun050_00000079_a47bb3dc1 header apart2 IPs13a11cun050_0000005b_d5e10d851 header apart11 IPs11

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.