HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cdn100_0034003f_d1da082f

Seen 2026-02-16 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS132203 sends an email when it next hits a sensor.

407

Source IPs

2

Networks

9

Countries

2

Ports hit

1.1K

Events

204

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS132203 Tencent Building, Kejizhongyi Avenue404 IPs1.1K
AS45102 Alibaba (US) Technology Co., Ltd.3 IPs8

Countries

US 221SG 46DE 33HK 24BR 23KR 22JP 18TH 12ID 8

Ports targeted

80/tcp 933443/tcp 155

What it requests

GET/1.1K
GET/cgi-bin/login.cgi1

User agents claimed

Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1407 IPs1.1K
Source IPCCNetwork Last seenEvents
43.157.67.70DEAS132203 Tencent Building, Kejizhongyi Avenue2026-09-309
43.167.245.18JPAS132203 Tencent Building, Kejizhongyi Avenue2026-09-288
43.157.191.20BRAS132203 Tencent Building, Kejizhongyi Avenue2026-09-248
43.165.198.144IDAS132203 Tencent Building, Kejizhongyi Avenue2026-09-288
43.164.196.47BRAS132203 Tencent Building, Kejizhongyi Avenue2026-09-297
43.157.172.39BRAS132203 Tencent Building, Kejizhongyi Avenue2026-09-217
43.130.32.245USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-257
43.157.150.69BRAS132203 Tencent Building, Kejizhongyi Avenue2026-09-307
43.163.80.48SGAS132203 Tencent Building, Kejizhongyi Avenue2026-09-287
43.165.198.5IDAS132203 Tencent Building, Kejizhongyi Avenue2026-09-306
43.159.34.167SGAS132203 Tencent Building, Kejizhongyi Avenue2026-09-296
43.131.36.84DEAS132203 Tencent Building, Kejizhongyi Avenue2026-09-256
43.134.236.36SGAS132203 Tencent Building, Kejizhongyi Avenue2026-09-276
101.32.52.164HKAS132203 Tencent Building, Kejizhongyi Avenue2026-09-296
43.166.239.145USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-236
170.106.152.218USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-156
43.134.62.67SGAS132203 Tencent Building, Kejizhongyi Avenue2026-09-286
43.157.62.101DEAS132203 Tencent Building, Kejizhongyi Avenue2026-09-196
43.164.196.244BRAS132203 Tencent Building, Kejizhongyi Avenue2026-09-306
43.153.76.247USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-275

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun090_0034003f_2b3ca27dsame header set5 IPs9b11cun090_0034003f_f5e9688asame header set1 IPs2b11cun090_0034003f_eaca82e6same header set2 IPs2b11cun080_0034001f_ee1daacd1 header apart762 IPs7.1Kb11cun080_0014003f_c4330fcc1 header apart6 IPs3.8Kb11cun080_0034003d_95095a1a1 header apart2 IPs1.4Kb11cdn090_0034003d_bf5282001 header apart240 IPs240b11cun080_00340037_c3a114251 header apart6 IPs203

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.