HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b10cun050_00040413_a4fc9b3e

Seen 2026-02-21 to 2026-09-29 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS210006 sends an email when it next hits a sensor.

41

Source IPs

9

Networks

10

Countries

109

Ports hit

5.0K

Events

5

IPs / network

Top networks

AS210006 Shereverov Marat Ahmedovich12 IPs1.7K
AS132359 M/S ROBI TRADERS7 IPs978
AS153947 FAST ZONE IT5 IPs716
AS153622 Madina IT5 IPs608
AS210328 AO ALMAZ4 IPs460
AS211486 Alferov Aleksey Aleksandrovich3 IPs229
AS213790 Limited Network LTD3 IPs64
AS44589 Digital Network S.r.l.1 IPs287
AS209605 UAB Host Baltic1 IPs28

Countries

TR 17DE 7SC 5KZ 4RU 3GB 1NL 1LT 1US 1IR 1

Ports targeted

443/tcp 1654433/tcp 1208080/tcp 5622443/tcp 5546443/tcp 5428443/tcp 5430443/tcp 534443/tcp 5264443/tcp 5240443/tcp 52643/tcp 5280/tcp 51

What it requests

GET/+CSCOE+/logon.html1.7K
GET/1.5K
GET/remote/login1.2K
GET/api/sonicos/is-sslvpn-enabled709
GET/RDWeb44

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3641 IPs5.0K
Source IPCCNetwork Last seenEvents
138.226.239.79GBAS44589 Digital Network S.r.l.2026-09-28287
185.136.15.55KZAS210328 AO ALMAZ2026-09-28217
185.136.15.19KZAS210328 AO ALMAZ2026-09-28216
45.154.244.145SCAS210006 Shereverov Marat Ahmedovich2026-09-28208
178.20.210.194DEAS210006 Shereverov Marat Ahmedovich2026-09-28205
178.20.210.183DEAS210006 Shereverov Marat Ahmedovich2026-09-28204
46.29.26.138TRAS132359 M/S ROBI TRADERS2026-09-28202
193.32.204.146TRAS153622 Madina IT2026-09-28202
178.20.210.145DEAS210006 Shereverov Marat Ahmedovich2026-09-28198
193.187.110.132TRAS153947 FAST ZONE IT2026-09-28194
77.91.71.78RUAS211486 Alferov Aleksey Aleksandrovich2026-09-28187
46.29.26.171TRAS132359 M/S ROBI TRADERS2026-09-28182
46.29.26.150TRAS132359 M/S ROBI TRADERS2026-09-28161
193.32.204.131TRAS153622 Madina IT2026-09-28159
46.29.26.140TRAS132359 M/S ROBI TRADERS2026-09-28158
193.187.110.153TRAS153947 FAST ZONE IT2026-09-28153
193.187.110.147TRAS153947 FAST ZONE IT2026-09-28152
178.20.210.173DEAS210006 Shereverov Marat Ahmedovich2026-09-28132
45.154.244.174SCAS210006 Shereverov Marat Ahmedovich2026-09-28130
46.29.26.149TRAS132359 M/S ROBI TRADERS2026-09-28128

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun050_00040413_2619b3acsame header set10 IPs289b11cun050_00040413_ca60424esame header set1 IPs4b11cun040_00040013_608dab681 header apart4.3K IPs243.3Kb11cun040_00040013_ab9bb0751 header apart57 IPs565b11cun060_00060413_0af44bea1 header apart40 IPs210b11cun040_00040411_2daa70d61 header apart7 IPs149b11cun040_00040013_7df024fe1 header apart2 IPs44b11cun040_00040013_2178e07e1 header apart12 IPs12

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.