HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun040_00040016_9e0aeda7

Seen 2026-02-16 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS10439 sends an email when it next hits a sensor.

50

Source IPs

16

Networks

11

Countries

2.8K

Ports hit

8.4K

Events

3

IPs / network

Top networks

AS10439 CariNet, Inc.13 IPs1.3K
AS174 Cogent Communications, LLC9 IPs4.5K
AS12989 Black HOST Ltd7 IPs1.5K
AS202425 IP Volume inc5 IPs880
AS14061 DigitalOcean, LLC4 IPs42
AS207043 Dedik Services Limited2 IPs94
AS209946 ALINDA LLC1 IPs117
AS200651 FlokiNET ehf1 IPs80
AS208137 Feo Prest SRL1 IPs2
AS48090 Techoff Srv Limited1 IPs2
AS12876 Scaleway SAS1 IPs1
AS3786 LG DACOM Corporation1 IPs1

Countries

US 27CA 7GB 6NL 6DE 3FR 2RU 1IS 1BG 1TW 1

Ports targeted

10000/tcp 5210444/tcp 418888/tcp 298000/tcp 294444/tcp 298080/tcp 274433/tcp 274282/tcp 2431337/tcp 238194/tcp 2380/tcp 238192/tcp 22

What it requests

GET/8.2K
GET/global-protect/login.esp15
GET/cgi-bin/welcome15
GET/dana-na/auth/url_default/welcome.cgi15
GET/remote/login15
GET/+CSCOE+/logon.html14
GET/RDWeb12
GET/tmui/login.jsp12
GET/my.policy12
GET/__api__/v1/config/domains12
GET/RDWeb/Pages/en-US/login.aspx12
GET/vpn/index12

User agents claimed

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.3637 IPs7.6K
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.3624 IPs510
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.365 IPs293
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.362 IPs2
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.152 IPs2
Source IPCCNetwork Last seenEvents
207.90.244.28USAS174 Cogent Communications, LLC2026-10-01698
207.90.244.17USAS174 Cogent Communications, LLC2026-10-01652
207.90.244.18USAS174 Cogent Communications, LLC2026-10-01642
207.90.244.19USAS174 Cogent Communications, LLC2026-10-01640
207.90.244.26USAS174 Cogent Communications, LLC2026-10-01546
207.90.244.12USAS174 Cogent Communications, LLC2026-10-01498
86.54.31.44CAAS12989 Black HOST Ltd2026-10-01483
207.90.244.4USAS174 Cogent Communications, LLC2026-10-01413
86.54.31.36CAAS12989 Black HOST Ltd2026-10-01412
207.90.244.6USAS174 Cogent Communications, LLC2026-10-01351
71.6.199.23USAS10439 CariNet, Inc.2026-10-01240
71.6.147.254USAS10439 CariNet, Inc.2026-10-01215
93.174.95.106NLAS202425 IP Volume inc2026-10-01213
71.6.135.131USAS10439 CariNet, Inc.2026-10-01200
80.82.77.139NLAS202425 IP Volume inc2026-10-01184
86.54.31.38CAAS12989 Black HOST Ltd2026-10-01183
94.102.49.193NLAS202425 IP Volume inc2026-10-01164
89.248.167.131NLAS202425 IP Volume inc2026-10-01160
80.82.77.33NLAS202425 IP Volume inc2026-10-01159
86.54.31.34CAAS12989 Black HOST Ltd2026-10-01157

Fingerprint family: 2 shapes, 1.3K IPs, 27.5K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 5 headers, no body: connection, accept-encoding, accept, user-agent, host

asks for/favicon.ico · / · /admin/assets/js/views/login.js · /admin/config.php (GET / HEAD)
asMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · python-requests/2.34.2 · Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0. and 1968 more
ports443 · 80 · 10000 · 8188
fromUS · GB · BE · NL · Google LLC · Cogent Communications, LLC · Amazon.com, Inc.
b11cun050_00040017_976354f0Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /favicon.ico1.3K IPs19.1Kb11cun040_00040016_9e0aeda7 this one+/- connection · Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0. · /50 IPs8.4K
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040016_aa48e2c8same header set6.2K IPs529.5Kb11cun040_00040016_4110f156same header set288 IPs171.1Kb11cun040_00040016_c1d30083same header set49 IPs6.4Kb11cun040_00040016_f36dd82esame header set9 IPs5.6Kb11cun040_00040016_c5bb04c5same header set68 IPs3.6Kb11cun040_00040016_fb523147same header set46 IPs3.2Kb11cun040_00040016_1d05953dsame header set11 IPs1.6Kb11cun040_00040016_50f90888same header set69 IPs1.3K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.