HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cuq070_0000064f_c865e68f

Seen 2026-09-22 to 2026-09-23 across the retained window.

Open in lookup →

13

Source IPs

12

Networks

10

Countries

4

Ports hit

17

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS152194 CTG Server Limited2 IPs2
AS24186 RailTel Corporation of India Ltd1 IPs3
AS14061 DigitalOcean, LLC1 IPs3
AS212238 Datacamp Limited1 IPs1
AS17816 China Unicom IP network China169 Guangdong province1 IPs1
AS17471 Grameen Cybernet Ltd. Bangladesh. AS for local peering and transit. Dhaka1 IPs1
AS134437 The Sky Traders (Pvt) Ltd1 IPs1
AS135223 Netway Internet Pvt Ltd1 IPs1
AS4788 TM TECHNOLOGY SERVICES SDN. BHD.1 IPs1
AS4766 Korea Telecom1 IPs1
AS59371 Dimension Network & Communication Limited1 IPs1
AS139952 PT Trisari Data Indonusa1 IPs1

Countries

IN 3BD 2US 1KR 1HK 1MY 1ID 1CN 1DE 1JP 1

Ports targeted

5985/tcp 1254321/tcp 380/tcp 1443/tcp 1

What it requests

POST/wsman12
POST/login3
POST/1
PUT/api/smartfilters/testexecutions1

User agents claimed

Python WinRM client10 IPs12
Mozilla/5.01 IPs3
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.361 IPs1
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.01 IPs1
Source IPCCNetwork Last seenEvents
137.59.94.89AS0 RailTel Corporation of India Ltd2026-09-233
134.199.238.38AS0 DigitalOcean, LLC2026-09-233
120.86.117.250AS0 China Unicom IP network China169 Guangdong province2026-09-221
115.132.29.228AS0 TM TECHNOLOGY SERVICES SDN. BHD.2026-09-231
137.220.221.39AS0 CTG Server Limited2026-09-231
147.90.209.187AS0 Datacamp Limited2026-09-231
103.77.63.234AS0 The Sky Traders (Pvt) Ltd2026-09-231
27.124.22.60AS0 CTG Server Limited2026-09-231
119.203.187.190AS0 Korea Telecom2026-09-231
203.83.164.178AS0 Grameen Cybernet Ltd. Bangladesh. AS for local peering and transit. Dhaka2026-09-231
139.5.196.35AS0 Netway Internet Pvt Ltd2026-09-221
203.175.125.156AS0 PT Trisari Data Indonusa2026-09-221
147.161.32.6AS0 Dimension Network & Communication Limited2026-09-231

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cuq070_0000064f_da0e6e28same header set1 IPs15a11cuq070_0000064f_af8c9b09same header set3 IPs7a11cuq070_0000064f_81cd6514same header set2 IPs2a11cuq070_0000064f_8574b2f3same header set1 IPs1a11cuq070_0000064f_e01bd4b6same header set1 IPs1a11cuq060_0000064b_9e42e2331 header apart2 IPs108a11cuq071_0000064b_0f6de22c1 header apart1 IPs12a11cuq137_0000064e_d10db4251 header apart3 IPs10

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.