HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun030_00040014_0a773432

Seen 2026-02-17 to 2026-09-29 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS213412 sends an email when it next hits a sensor.

38

Source IPs

1

Networks

2

Countries

2

Ports hit

39

Events

38

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS213412 ONYPHE SAS38 IPs39

Countries

FR 25US 13

Ports targeted

6443/tcp 2616443/tcp 13

What it requests

GET/version?timeout=32s39

User agents claimed

kubectl/v1.15.2 (linux/amd64) kubernetes/f62783038 IPs39
Source IPCCNetwork Last seenEvents
91.231.89.158FRAS213412 ONYPHE SAS2026-09-132
91.230.168.134USAS213412 ONYPHE SAS2026-09-181
91.231.89.39FRAS213412 ONYPHE SAS2026-09-241
91.231.89.99FRAS213412 ONYPHE SAS2026-09-211
91.196.152.69FRAS213412 ONYPHE SAS2026-09-271
195.184.76.81USAS213412 ONYPHE SAS2026-09-201
91.230.168.81USAS213412 ONYPHE SAS2026-09-101
91.231.89.17FRAS213412 ONYPHE SAS2026-09-171
91.196.152.107FRAS213412 ONYPHE SAS2026-09-131
91.231.89.49FRAS213412 ONYPHE SAS2026-09-231
91.230.168.238USAS213412 ONYPHE SAS2026-09-201
91.230.168.37USAS213412 ONYPHE SAS2026-09-081
195.184.76.84USAS213412 ONYPHE SAS2026-09-041
91.230.168.194USAS213412 ONYPHE SAS2026-09-041
91.196.152.108FRAS213412 ONYPHE SAS2026-09-081
91.231.89.21FRAS213412 ONYPHE SAS2026-09-021
91.196.152.60FRAS213412 ONYPHE SAS2026-09-291
91.196.152.49FRAS213412 ONYPHE SAS2026-09-181
91.196.152.117FRAS213412 ONYPHE SAS2026-09-091
91.230.168.192USAS213412 ONYPHE SAS2026-09-111

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun030_00040014_03330a18same header set3.9K IPs1.4Mb11cun030_00040014_54d07b6dsame header set3.7K IPs135.9Kb10cun030_00040014_54d07b6dsame header set53 IPs528b11cun030_00040014_e29c64acsame header set1 IPs80b11cun030_00040014_a626bc27same header set1 IPs66b11cdn040_00040014_6e8c246csame header set1 IPs2b11cun030_00040014_b32be002same header set1 IPs1b10cun020_00000014_0a8d7f111 header apart2.0K IPs617.5K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.