HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun030_00040014_54d07b6d

Seen 2026-02-16 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

3.7K

Source IPs

52

Networks

25

Countries

8.6K

Ports hit

105.0K

Events

71

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.2.6K IPs14.7K
AS396982 Google LLC576 IPs1.9K
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED235 IPs22.0K
AS6939 Hurricane Electric LLC62 IPs214
AS14061 DigitalOcean, LLC45 IPs229
AS50219 Valence Technology Co.12 IPs1.4K
AS10439 CariNet, Inc.11 IPs1.3K
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.9 IPs49
AS29465 MTN NIGERIA Communication limited9 IPs9
AS36352 HostPapa7 IPs68
AS400619 AROSSCLOUD INC.7 IPs33
AS142002 Scloud Pte Ltd6 IPs436

Countries

US 1.4KJP 517SG 492DE 482MY 446HK 97BE 61GB 41TH 37NG 30

Ports targeted

80/tcp 30.7K443/tcp 30.7K8161/tcp 3619200/tcp 3198080/tcp 2438443/tcp 2053000/tcp 1839443/tcp 1828000/tcp 1773306/tcp 1697547/tcp 14810000/tcp 143

What it requests

GET/39.5K
GET/favicon.ico3.0K
HEAD/selfupdate/wuident.cab214
GET/v1/models103
GET/_cat/indices46
GET/api/jobs/32
GET/wp-sitemap-posts-page-1.xml12
GET/wp-json/wp/v2/pages?per_page=100&_fields=id,slug,template12
GET/_all_dbs12
GET/index.php?rest_route=/wp/v2/pages&per_page=100&_fields=id,slug,template12
GET/.env.test12
GET/.env11

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.361 IPs60.9K
curl/7.29.0241 IPs22.5K
curl/7.64.12.6K IPs14.7K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3626 IPs3.0K
curl/7.68.0517 IPs1.8K
Source IPCCNetwork Last seenEvents
45.148.10.183NLAS48090 Techoff Srv Limited2026-09-0760.9K
93.123.109.214BGAS48090 Techoff Srv Limited2026-09-25539
176.65.144.71CHAS209413 Dedik Services Limited2026-09-21288
216.226.76.30USAS50219 Valence Technology Co.2026-09-30191
216.226.77.10USAS50219 Valence Technology Co.2026-10-01175
216.226.77.30USAS50219 Valence Technology Co.2026-10-01165
71.6.134.237USAS10439 CariNet, Inc.2026-10-01164
216.226.77.20USAS50219 Valence Technology Co.2026-10-01158
71.6.134.231USAS10439 CariNet, Inc.2026-10-01155
71.6.134.236USAS10439 CariNet, Inc.2026-09-30154
165.154.173.204USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-29154
203.55.131.5USAS32475 Internap Holding LLC2026-10-01152
203.55.131.3USAS32475 Internap Holding LLC2026-09-30146
118.193.64.15GBAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-29138
194.164.107.5USAS50219 Valence Technology Co.2026-10-01138
165.154.129.74GBAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-29138
71.6.134.233USAS10439 CariNet, Inc.2026-10-01136
165.154.172.37USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-29134
101.36.119.146HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-29133
152.32.206.38USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-28132

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun030_00040014_03330a18same header set3.9K IPs1.4Mb10cun030_00040014_54d07b6dsame header set53 IPs517b11cun030_00040014_0a773432same header set39 IPs39b10cun020_00000014_0a8d7f111 header apart2.0K IPs606.5Kb11cun040_00040016_aa48e2c81 header apart6.2K IPs529.5Kb11cun040_00040016_4110f1561 header apart288 IPs171.1Kb11cun040_00040015_4c87b06e1 header apart1.5K IPs152.7Kb11cun020_00040010_724c10fb1 header apart1.4K IPs70.5K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.