HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun040_00040016_c1d30083

Seen 2026-05-19 to 2026-09-29 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS31898 sends an email when it next hits a sensor.

48

Source IPs

4

Networks

4

Countries

9

Ports hit

6.4K

Events

12

IPs / network

Top networks

AS31898 Oracle Corporation45 IPs3.5K
AS30860 Virtual Systems LLC1 IPs2.8K
AS201814 MEVSPACE sp. z o.o.1 IPs22
AS208137 Feo Prest SRL1 IPs2

Countries

SG 45UA 1PL 1DE 1

Ports targeted

443/tcp 3.5K8000/tcp 69780/tcp 5825000/tcp 5303000/tcp 5158080/tcp 50459999/tcp 78089/tcp 48090/tcp 4

What it requests

HEAD/224
GET/.env119
GET/.env.local108
GET/config.json97
GET/.env.bak96
GET/.git/config90
GET/actuator/env90
GET/.git/HEAD89
GET/.env.production89
GET/phpinfo.php86
GET/server-status85
POST/login85

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.3645 IPs3.5K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.361 IPs2.8K
Mozilla/5.0 (compatible; ip_scanner/1.0)1 IPs22
Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)1 IPs2
Source IPCCNetwork Last seenEvents
185.254.197.231UAAS30860 Virtual Systems LLC2026-09-022.8K
134.185.93.91SGAS31898 Oracle Corporation2026-09-05318
161.118.217.10SGAS31898 Oracle Corporation2026-09-07265
138.2.108.89SGAS31898 Oracle Corporation2026-09-07212
168.107.72.188SGAS31898 Oracle Corporation2026-09-05212
134.185.89.5SGAS31898 Oracle Corporation2026-09-05212
161.118.211.119SGAS31898 Oracle Corporation2026-09-04212
138.2.85.36SGAS31898 Oracle Corporation2026-09-05106
168.107.90.53SGAS31898 Oracle Corporation2026-09-05106
168.107.65.60SGAS31898 Oracle Corporation2026-09-07106
213.35.108.87SGAS31898 Oracle Corporation2026-09-0799
161.118.224.183SGAS31898 Oracle Corporation2026-09-0789
213.35.118.30SGAS31898 Oracle Corporation2026-09-0781
161.118.220.224SGAS31898 Oracle Corporation2026-09-0763
161.118.209.189SGAS31898 Oracle Corporation2026-09-0754
161.118.198.110SGAS31898 Oracle Corporation2026-09-0754
213.35.109.145SGAS31898 Oracle Corporation2026-09-0754
161.118.241.225SGAS31898 Oracle Corporation2026-09-0453
158.178.234.142SGAS31898 Oracle Corporation2026-09-0753
140.245.108.34SGAS31898 Oracle Corporation2026-09-0453

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040016_aa48e2c8same header set6.2K IPs527.5Kb11cun040_00040016_4110f156same header set261 IPs173.0Kb11cun040_00040016_9e0aeda7same header set52 IPs8.4Kb11cun040_00040016_f36dd82esame header set9 IPs5.5Kb11cun040_00040016_c5bb04c5same header set65 IPs3.5Kb11cun040_00040016_fb523147same header set46 IPs3.2Kb11cun040_00040016_1d05953dsame header set11 IPs1.6Kb11cun040_00040016_50f90888same header set70 IPs1.3K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.