HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b10cun020_00000014_0a8d7f11

Seen 2026-09-30 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

184

Source IPs

4

Networks

4

Countries

184

Ports hit

201

Events

46

IPs / network

Top networks

AS396982 Google LLC178 IPs193
AS202425 IP Volume inc3 IPs5
AS214664 JSC F62 IPs2
Unattributed1 IPs1

Countries

US 117GB 61NL 3RU 3

Ports targeted

80/tcp 95687/tcp 237095/tcp 246715/tcp 236055/tcp 234599/tcp 230699/tcp 225551/tcp 223211/tcp 220195/tcp 214423/tcp 148951/tcp 1

What it requests

GET/201

User agents claimed

Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity176 IPs187
Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)2 IPs6
Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.161 IPs2
Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.8.1.12) Gecko/20080303 SeaMonkey/1.1.81 IPs1
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 YaBrowser/18.3.1.1220 Yowser/2.5 Safari/537.361 IPs1
Source IPCCNetwork Last seenEvents
216.180.246.46USAS396982 Google LLC2026-09-305
162.216.150.205USAS396982 Google LLC2026-09-303
147.185.132.68USAS396982 Google LLC2026-09-302
89.248.172.10NLAS202425 IP Volume inc2026-09-302
147.185.132.86USAS396982 Google LLC2026-09-302
89.248.172.11NLAS202425 IP Volume inc2026-09-302
35.203.211.206GBAS396982 Google LLC2026-09-302
35.203.210.183GBAS396982 Google LLC2026-09-302
162.216.150.227USAS396982 Google LLC2026-09-302
35.203.210.58GBAS396982 Google LLC2026-09-302
35.203.211.29GBAS396982 Google LLC2026-09-302
35.203.211.144GBAS396982 Google LLC2026-09-302
162.216.149.117USAS396982 Google LLC2026-09-302
147.185.133.99USAS396982 Google LLC2026-09-301
162.216.150.127USAS396982 Google LLC2026-09-301
89.248.172.14NLAS202425 IP Volume inc2026-09-301
147.185.133.166USAS396982 Google LLC2026-09-301
35.203.210.62GBAS396982 Google LLC2026-09-301
162.216.150.72USAS396982 Google LLC2026-09-301
162.216.150.229USAS396982 Google LLC2026-09-301

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun030_00040014_03330a181 header apart1 IPs2.9Kb11cun030_00040014_54d07b6d1 header apart45 IPs47b10cun010_00000004_a37af9cb1 header apart1 IPs1b10cun030_00040014_54d07b6d1 header apart1 IPs1b11cun040_00040016_aa48e2c82 headers apart379 IPs1.3Kb11cun040_00040016_4110f1562 headers apart28 IPs559b10lun000_00000000_334359b92 headers apart13 IPs47b11cun040_00040015_4c87b06e2 headers apart3 IPs43

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.