HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun160_005cf97d_d92d9ef7

Seen 2026-09-22 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS212512 sends an email when it next hits a sensor.

4

Source IPs

1

Networks

1

Countries

75

Ports hit

77

Events

4

IPs / network

Top networks

AS212512 Detai Prosperous Technologies Limited4 IPs77

Countries

US 4

Ports targeted

1352/tcp 25054/tcp 2340/tcp 154321/tcp 11077/tcp 11163/tcp 1785/tcp 11417/tcp 11461/tcp 11658/tcp 11687/tcp 12043/tcp 1

What it requests

GET/favicon.ico77

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.9.12 Chrome/138.0.7204.235 Electron/37.3.1 Safari/537.363 IPs4
Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.02 IPs4
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.153 IPs3
Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.02 IPs3
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.362 IPs3
Source IPCCNetwork Last seenEvents
45.131.155.102AS0 Detai Prosperous Technologies Limited2026-09-2422
45.131.155.103AS0 Detai Prosperous Technologies Limited2026-09-2421
45.131.155.100AS0 Detai Prosperous Technologies Limited2026-09-2419
45.131.155.101AS0 Detai Prosperous Technologies Limited2026-09-2415

Fingerprint family: 2 shapes, 4 IPs, 350 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 16 headers, no body: accept, accept-encoding, host, accept-language, upgrade-insecure-requests, user-agent, cache-control, sec-fetch-mode, pragma, sec-fetch-dest, sec-fetch-site, sec-fetch-user, sec-ch-ua-platform, sec-ch-ua-mobile, sec-ch-ua, referer

asks for/favicon.ico (GET)
asMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 · Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 and 118 more
ports2332 · 93 · 49665 · 1352
fromUS · Detai Prosperous Technologies Limited
a11cun160_005cf97d_7acbd9b1Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /favicon.ico4 IPs273a11cun160_005cf97d_d92d9ef7 this oneMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /favicon.ico4 IPs77
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun160_005cf97d_7acbd9b1same header set4 IPs273a11cun150_001cf97d_49a625511 header apart45 IPs1.6K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.