HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun050_00040017_345c845b

Seen 2026-02-16 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14618 sends an email when it next hits a sensor.

465

Source IPs

6

Networks

4

Countries

77

Ports hit

2.6K

Events

78

IPs / network

Top networks

AS14618 Amazon.com, Inc.459 IPs599
AS396982 Google LLC2 IPs27
AS31898 Oracle Corporation1 IPs1.9K
AS51396 Pfcloud UG (haftungsbeschrankt)1 IPs32
AS4134 Chinanet1 IPs3
AS215599 Zkillu SAS1 IPs2

Countries

US 462NL 1CN 1FR 1

Ports targeted

8443/tcp 2995173/tcp 240443/tcp 2309443/tcp 2274443/tcp 2238000/tcp 18880/tcp 1865175/tcp 1515174/tcp 1513000/tcp 468080/tcp 389119/tcp 27

What it requests

GET/653
GET/.env67
GET/wp-config.php.bak52
GET/info.php52
GET/docker-compose.yaml52
GET/.git/HEAD52
GET/config.js52
GET/.git/config52
GET/.docker/config.json52
GET/@vite/client52
GET/wp-config.php52
GET/terraform.tfvars51

User agents claimed

Mozilla/5.0 (compatible; research-scan/1.0)1 IPs1.9K
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36459 IPs599
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.361 IPs32
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.362 IPs27
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)1 IPs3
Source IPCCNetwork Last seenEvents
129.213.151.234USAS31898 Oracle Corporation2026-09-271.9K
176.65.148.71NLAS51396 Pfcloud UG (haftungsbeschrankt)2026-09-2332
35.238.120.46USAS396982 Google LLC2026-09-1218
34.170.15.1USAS396982 Google LLC2026-09-129
18.97.26.12USAS14618 Amazon.com, Inc.2026-09-294
44.220.185.32USAS14618 Amazon.com, Inc.2026-09-194
98.80.4.120USAS14618 Amazon.com, Inc.2026-09-274
18.97.26.124USAS14618 Amazon.com, Inc.2026-09-233
44.220.188.103USAS14618 Amazon.com, Inc.2026-09-153
44.220.188.205USAS14618 Amazon.com, Inc.2026-09-293
98.80.4.67USAS14618 Amazon.com, Inc.2026-09-203
18.97.26.108USAS14618 Amazon.com, Inc.2026-09-223
98.80.4.63USAS14618 Amazon.com, Inc.2026-09-083
124.239.152.79CNAS4134 Chinanet2026-09-233
44.220.188.209USAS14618 Amazon.com, Inc.2026-09-143
18.97.19.251USAS14618 Amazon.com, Inc.2026-09-263
98.80.4.73USAS14618 Amazon.com, Inc.2026-09-143
44.220.188.126USAS14618 Amazon.com, Inc.2026-09-243
44.220.185.72USAS14618 Amazon.com, Inc.2026-09-113
18.97.26.122USAS14618 Amazon.com, Inc.2026-09-213

Fingerprint family: 2 shapes, 465 IPs, 2.6K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 5 headers, no body: connection, accept-encoding, accept, user-agent, host

asks for/ · /.env · /config.js · /.docker/config.json (GET)
asMozilla/5.0 (compatible; research-scan/1.0) · Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like · Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 and 24 more
ports8443 · 5173 · 443 · 9443
fromUS · NL · CN · FR · Oracle Corporation · Amazon.com, Inc. · Pfcloud UG (haftungsbeschrankt)
b11cun050_00040017_345c845b this oneMozilla/5.0 (compatible; research-scan/1.0) · /465 IPs2.6Kb11cun060_0004001f_f6be99b4+/- accept-language · Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chr · /v1/openapi.json4 IPs20
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun050_00040017_976354f0same header set1.3K IPs19.1Kb11cun050_00040017_6b90553bsame header set1.3K IPs9.4Kb11cun050_00040017_e873236csame header set709 IPs6.2Kb11cun050_00040017_d1f380a6same header set4 IPs3.6Kb11cun050_00040017_eba289fesame header set19 IPs2.8Kb11cun050_00040017_97f1d74fsame header set38 IPs2.0Kb11cun050_00040017_2015d6b2same header set524 IPs1.2Kb11cun050_00040017_ee17dab1same header set4 IPs812

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.