HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun149_0000004f_abf74e9d

Seen 2026-09-23 to 2026-09-23 across the retained window.

Open in lookup →

7

Source IPs

1

Networks

1

Countries

1

Ports hit

129

Events

7

IPs / network

Top networks

AS13335 Cloudflare, Inc.7 IPs129

Countries

HK 7

Ports targeted

443/tcp 129

What it requests

GET/api/config2
GET/internal/.env1
GET/media../.env1
GET/shared/.env1
GET/config.py1
GET/static//app/.env1
GET/.ssh/known_hosts1
GET/runtime-config.js1
GET/config/settings.py1
GET/account/_payload.json1
GET/proc/self/cmdline1
GET/local.settings.json1

User agents claimed

Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)3 IPs10
Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)4 IPs10
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot3 IPs9
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)5 IPs9
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)4 IPs8
Source IPCCNetwork Last seenEvents
172.71.210.193HKAS13335 Cloudflare, Inc.2026-09-2351
162.158.114.77HKAS13335 Cloudflare, Inc.2026-09-2329
162.158.114.76HKAS13335 Cloudflare, Inc.2026-09-2323
172.71.210.192HKAS13335 Cloudflare, Inc.2026-09-2323
162.158.193.88HKAS13335 Cloudflare, Inc.2026-09-231
172.68.211.116HKAS13335 Cloudflare, Inc.2026-09-231
162.159.98.26HKAS13335 Cloudflare, Inc.2026-09-231

Fingerprint family: 2 shapes, 7 IPs, 174 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 14 headers, no body, 9 outside the vocabulary: accept, connection, accept-encoding, host, user-agent

asks for/runtime-config.js · /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_r · /serverless.yaml · /temp/.env (GET)
asMozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.co · Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html) · Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/) and 46 more
ports443
fromHK · Cloudflare, Inc.
a11cun149_0000004f_abf74e9d this oneMozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html) · /runtime-config.js7 IPs129a11cun149_0000004f_0366fcaeMozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/) · /@fs/src/.env?raw??6 IPs45
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun050_0000004f_0d8a8ff5same header set84 IPs762a11cun050_0000004f_af924659same header set30 IPs249a11cun050_0000004f_90cbaab3same header set56 IPs132a11cun050_0000004f_16dcd1e4same header set2 IPs45a11cun149_0000004f_0366fcaesame header set6 IPs45a11cun050_0000004f_588d51acsame header set1 IPs18a11cun050_0000004f_5938b494same header set1 IPs18a11cun050_0000004f_94db1cf7same header set14 IPs14

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.