HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun060_00c0004e_0af44bea

Seen 2026-09-25 to 2026-09-25 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

39

Source IPs

1

Networks

2

Countries

49

Ports hit

208

Events

39

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14061 DigitalOcean, LLC39 IPs208

Countries

DE 20US 19

Ports targeted

3001/tcp 83000/tcp 65001/tcp 62082/tcp 6444/tcp 5808/tcp 55000/tcp 52083/tcp 57002/tcp 410000/tcp 42222/tcp 42375/tcp 4

What it requests

GET/208

User agents claimed

Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.363 IPs4
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.363 IPs3
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.363 IPs3
Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.123 IPs3
Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.362 IPs2
Source IPCCNetwork Last seenEvents
162.243.226.225USAS14061 DigitalOcean, LLC2026-09-2511
161.35.221.135DEAS14061 DigitalOcean, LLC2026-09-2510
165.227.141.56DEAS14061 DigitalOcean, LLC2026-09-259
147.182.140.20USAS14061 DigitalOcean, LLC2026-09-259
165.227.167.59DEAS14061 DigitalOcean, LLC2026-09-259
46.101.227.193DEAS14061 DigitalOcean, LLC2026-09-258
192.241.160.85USAS14061 DigitalOcean, LLC2026-09-257
104.131.233.218USAS14061 DigitalOcean, LLC2026-09-257
164.90.238.135DEAS14061 DigitalOcean, LLC2026-09-257
167.99.12.84USAS14061 DigitalOcean, LLC2026-09-257
159.89.20.206DEAS14061 DigitalOcean, LLC2026-09-256
137.184.217.216USAS14061 DigitalOcean, LLC2026-09-256
192.241.168.220USAS14061 DigitalOcean, LLC2026-09-256
46.101.174.66DEAS14061 DigitalOcean, LLC2026-09-256
201.79.3.253DEAS14061 DigitalOcean, LLC2026-09-256
162.243.11.223USAS14061 DigitalOcean, LLC2026-09-255
107.170.59.14USAS14061 DigitalOcean, LLC2026-09-255
64.225.97.56DEAS14061 DigitalOcean, LLC2026-09-255
146.190.74.36USAS14061 DigitalOcean, LLC2026-09-255
138.197.177.108DEAS14061 DigitalOcean, LLC2026-09-255

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a10cun050_0040004e_844abc4b1 header apart36 IPs4.9Ka11cun050_0080004e_3ef9a8f61 header apart74 IPs2.0Ka11cun050_0040004e_80f24cce1 header apart1 IPs10a11cun061_0040004e_be5a5cc71 header apart1 IPs3a11cuk061_0040004e_be5a5cc71 header apart1 IPs2a11cun050_0040004e_dae12bdf1 header apart1 IPs2a11cun127_0040004e_16fd481b1 header apart1 IPs1a11cun127_0040004e_ebc59d081 header apart1 IPs1

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.