HoneyLabs

Akin HTTP request fingerprint

a11cuq030_00000248_e62b6d85

Seen 2026-09-22 to 2026-09-23 across the retained window.

3

Source IPs

2

Networks

2

Countries

102

Ports hit

103

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

Countries

DE 2CZ 1

Ports targeted

What it requests

POST/clients102
GET/1

User agents claimed

what-vpn-go/0.12 IPs102
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.361 IPs1
Source IPCCNetwork Last seenEvents
94.26.83.79DEAS207043 Dedik Services Limited2026-09-2354
91.92.43.222DEAS207043 Dedik Services Limited2026-09-2348
82.114.200.50CZAS41046 O2 Czech Republic, a.s.2026-09-221

Fingerprint family: 4 shapes, 97 IPs, 856 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 2 headers, no body: host, user-agent

asks for/ · /my.policy · /myvpn?sess=none&hdlc_framing=no&ipv4=1&ipv6=1&Z=none&hostna · /vpntunnel (GET / HEAD)
aswhat-vpn-go/0.1 · fasthttp · Hello from Palo Alto Networks, find out more about our scans in https://docs-cor and 76 more
ports443 · 8080 · 9500 · 8090
fromDE · US · RU · NL · Dedik Services Limited · Hurricane Electric LLC · JSC F6
a11cun020_00000048_724c10fbwhat-vpn-go/0.1 · /97 IPs555a11cuq030_00000248_e62b6d85 this one+/- content-length · what-vpn-go/0.1 · /clients3 IPs101a11cun031_00000048_e62b6d85ncsrv · /dana-na2 IPs100a11cun064_00000048_f2f3ae25what-vpn-go/0.1 · /sslvpnclient?launchplatform=mac&neProto=3&supportipv6=yes2 IPs100

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun020_00000048_724c10fb1 header apart97 IPs563a11cun064_00000048_f2f3ae251 header apart2 IPs102a11cun031_00000048_e62b6d851 header apart2 IPs102a11cuq062_00000648_f2f3ae251 header apart2 IPs102a11cuq040_0000024a_2daa70d61 header apart52 IPs72a10cun020_00000048_724c10fb1 header apart2 IPs16a11cuq051_00000648_800b45671 header apart2 IPs2a11cuq051_0000024a_87980a971 header apart1 IPs1

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.