HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun040_00040016_f36dd82e

Seen 2026-02-16 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS135377 sends an email when it next hits a sensor.

9

Source IPs

3

Networks

4

Countries

433

Ports hit

5.5K

Events

3

IPs / network

Top networks

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED4 IPs3.4K
AS63199 CDS Global Cloud Co., Ltd4 IPs1.8K
AS56046 China Mobile communications corporation1 IPs314

Countries

US 5HK 2CN 1SC 1

Ports targeted

7860/tcp 509081/tcp 458066/tcp 405678/tcp 404043/tcp 362014/tcp 3628080/tcp 3510035/tcp 358444/tcp 357500/tcp 353528/tcp 35689/tcp 35

What it requests

GET/favicon.ico1.1K
GET/llms.txt1.1K
GET/sitemap.xml1.1K
GET/robots.txt1.1K
GET/.well-known/security.txt1.1K
GET/favicon.ico/4
GET/robots.txt/4
GET/.well-known/security.txt/4
GET/llms.txt/2
GET/1
GET/sitemap.xml/1

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.369 IPs5.5K
Source IPCCNetwork Last seenEvents
150.107.38.251HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-301.1K
150.107.36.236HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-301.1K
165.154.163.10USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-301.1K
148.153.56.170USAS63199 CDS Global Cloud Co., Ltd2026-09-30495
148.153.56.174USAS63199 CDS Global Cloud Co., Ltd2026-09-30470
148.153.188.246USAS63199 CDS Global Cloud Co., Ltd2026-09-30404
148.153.188.254USAS63199 CDS Global Cloud Co., Ltd2026-09-30404
36.156.22.2CNAS56046 China Mobile communications corporation2026-09-29314
154.197.56.163SCAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-29100

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040016_aa48e2c8same header set6.2K IPs527.6Kb11cun040_00040016_4110f156same header set259 IPs173.0Kb11cun040_00040016_9e0aeda7same header set52 IPs8.4Kb11cun040_00040016_c1d30083same header set48 IPs6.4Kb11cun040_00040016_c5bb04c5same header set65 IPs3.5Kb11cun040_00040016_fb523147same header set46 IPs3.2Kb11cun040_00040016_1d05953dsame header set11 IPs1.6Kb11cun040_00040016_50f90888same header set70 IPs1.3K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.