HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuk051_00040013_2619b3ac_xed80

Seen 2026-04-17 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

1

Source IPs

1

Networks

1

Countries

1

Ports hit

30

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS48090 Techoff Srv Limited1 IPs30

Countries

BG 1

Ports targeted

443/tcp 30

What it requests

POST/wp-admin/index.php4
POST/hms/user-login.php2
PUT/wp-json/seopress/v1/posts/1/title-description-metas2
POST/wp-admin/admin-ajax.php?action=proxy_image&url=/etc/passwd2
POST/sitemap.xml?offset=1;SELECT%20IF((SLEEP(6)),1,2356)2
POST/sitemap.xml?offset=1;SELECT%20IF((SLEEP(16)),1,2356)2
POST/business-directory/?dosrch=1&q&wpbdp_view=search&listingfields[+or+sleep(if(1%3d1,6,0))+))--+-][1]2
POST/app/rest/users/id:1/tokens/RPC22
POST/actuator/gateway/refresh2
POST/Visitor/bin/WebStrings.srf?obj_name=win.ini2
POST/wp-admin/admin-ajax.php?action=proxy_image&url=/windows/win.ini2
PUT/szl388qd1

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.151 IPs2
Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/620.32 (KHTML, like Gecko) Version/17.1.10 Safari/620.321 IPs2
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/59.01 IPs1
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.151 IPs1
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.151 IPs1
Source IPCCNetwork Last seenEvents
93.123.109.214BGAS48090 Techoff Srv Limited2026-09-3030

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040013_608dab681 header apart4.3K IPs243.3Kb11cun040_00040013_ab9bb0751 header apart57 IPs565b11cun040_00040013_7df024fe1 header apart2 IPs43b11cun040_00040013_2178e07e1 header apart12 IPs12b11cun040_00040013_89f46b261 header apart4 IPs12b11cun040_00040013_6c646f8f1 header apart5 IPs5b11cdn050_00040013_9c46f2b01 header apart1 IPs2b11cun051_00040013_2619b3ac_xff632 headers apart1 IPs6

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.