HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun040_00040016_aa48e2c8

Seen 2026-02-16 to 2026-10-15 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS8075 sends an email when it next hits a sensor.

5.4K

Source IPs

87

Networks

42

Countries

49.0K

Ports hit

474.9K

Events

62

IPs / network

Top networks

AS8075 Microsoft Corporation1.8K IPs8.3K
AS6939 Hurricane Electric LLC981 IPs86.6K
AS14061 DigitalOcean, LLC677 IPs43.0K
AS398324 Censys, Inc.366 IPs93.3K
AS14618 Amazon.com, Inc.305 IPs2.0K
AS396982 Google LLC254 IPs19.0K
AS211680 Sistemas Informaticos, S.A.207 IPs5.3K
AS21859 Zenlayer Inc187 IPs7.3K
AS63949 Akamai Connected Cloud118 IPs6.1K
AS398722 Censys, Inc.96 IPs10.6K
AS209334 Modat B.V.72 IPs18.3K
AS22168 The Shadowserver Foundation, Inc.56 IPs3.9K

Countries

US 4.5KPT 394DE 165CA 84NL 55FR 33CN 28MN 25IN 21GB 21

Ports targeted

443/tcp 19.2K80/tcp 18.9K8080/tcp 5.5K8443/tcp 4.6K9090/tcp 3.2K3000/tcp 2.3K4444/tcp 2.3K8090/tcp 2.2K4443/tcp 2.1K9200/tcp 2.0K9443/tcp 1.9K8888/tcp 1.9K

What it requests

GET/186.3K
GET/squid-internal-mgr/cachemgr.cgi37.2K
GET/favicon.ico26.8K
GET/login7.4K
GET/robots.txt7.3K
GET/.well-known/security.txt6.7K
GET/security.txt6.5K
GET/ai/site-profile.json6.2K
GET/wiki6.2K
GET/ads.txt6.1K
GET/sitemap.xml6.1K
GET/sellers.json6.1K

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)478 IPs184.5K
Mozilla/5.0 zgrab/0.x2.3K IPs48.5K
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.3612 IPs39.3K
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)12 IPs32.4K
Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)276 IPs21.1K
Source IPCCNetwork Last seenEvents
168.144.77.101INAS14061 DigitalOcean, LLC2026-09-2836.7K
3.129.187.38USAS16509 Amazon.com, Inc.2026-10-159.8K
18.116.101.220USAS16509 Amazon.com, Inc.2026-10-139.8K
18.218.118.203USAS16509 Amazon.com, Inc.2026-10-159.4K
87.120.104.29NOAS211443 Sino Worldwide Trading Limited2026-10-106.8K
3.130.168.2USAS16509 Amazon.com, Inc.2026-10-156.7K
167.94.146.57USAS398705 Censys, Inc.2026-10-155.3K
167.94.146.49USAS398705 Censys, Inc.2026-10-155.2K
167.94.146.61USAS398705 Censys, Inc.2026-10-155.2K
167.94.146.62USAS398705 Censys, Inc.2026-10-155.1K
167.94.146.55USAS398705 Censys, Inc.2026-10-155.1K
167.94.146.53USAS398705 Censys, Inc.2026-10-155.1K
167.94.146.58USAS398705 Censys, Inc.2026-10-155.0K
167.94.146.60USAS398705 Censys, Inc.2026-10-155.0K
167.94.146.50USAS398705 Censys, Inc.2026-10-155.0K
167.94.146.51USAS398705 Censys, Inc.2026-10-155.0K
167.94.146.48USAS398705 Censys, Inc.2026-10-155.0K
167.94.146.59USAS398705 Censys, Inc.2026-10-155.0K
167.94.146.54USAS398705 Censys, Inc.2026-10-154.9K
167.94.146.56USAS398705 Censys, Inc.2026-10-154.9K

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040016_4110f156same header set319 IPs133.3Kb11cun040_00040016_c1d30083same header set56 IPs13.3Kb11cun040_00040016_9e0aeda7same header set51 IPs9.0Kb11cun040_00040016_c5bb04c5same header set121 IPs6.6Kb11cun040_00040016_f36dd82esame header set9 IPs6.5Kb11cun040_00040016_50f90888same header set70 IPs1.3Kb11cun040_00040016_fb523147same header set26 IPs1.3Kb11cun040_00040016_1d05953dsame header set9 IPs1.1K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.