HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun050_00040017_eba289fe

Seen 2026-04-12 to 2026-09-27 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS213790 sends an email when it next hits a sensor.

19

Source IPs

2

Networks

3

Countries

66

Ports hit

2.8K

Events

10

IPs / network

Top networks

AS213790 Limited Network LTD18 IPs2.7K
AS208137 Feo Prest SRL1 IPs73

Countries

NL 10US 8DE 1

Ports targeted

10443/tcp 728443/tcp 724443/tcp 724433/tcp 72443/tcp 711000/tcp 47333/tcp 4020001/tcp 402222/tcp 402443/tcp 403000/tcp 403001/tcp 40

What it requests

GET/remote/login422
GET/auth1.js422
GET/fonts/ftnt-icons.woff422
GET/lato-regular.woff2422
GET/+CSCOU+/csco_logo.gif422
GET/auth_portal/Default/logo.gif421
GET/login275

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3619 IPs2.8K
Source IPCCNetwork Last seenEvents
192.253.248.108NLAS213790 Limited Network LTD2026-09-27212
192.253.248.105NLAS213790 Limited Network LTD2026-09-24209
172.94.9.241USAS213790 Limited Network LTD2026-09-27200
172.94.9.242USAS213790 Limited Network LTD2026-09-24188
172.94.9.240USAS213790 Limited Network LTD2026-09-09181
172.94.9.45USAS213790 Limited Network LTD2026-09-09174
172.94.9.47USAS213790 Limited Network LTD2026-09-27171
172.94.9.243USAS213790 Limited Network LTD2026-09-27169
192.253.248.107NLAS213790 Limited Network LTD2026-09-24163
172.94.9.187USAS213790 Limited Network LTD2026-09-09154
192.253.248.109NLAS213790 Limited Network LTD2026-09-27142
192.253.248.106NLAS213790 Limited Network LTD2026-09-09133
192.253.248.110NLAS213790 Limited Network LTD2026-09-24128
192.253.248.115NLAS213790 Limited Network LTD2026-09-27111
172.94.9.46USAS213790 Limited Network LTD2026-09-27107
192.253.248.112NLAS213790 Limited Network LTD2026-09-09100
192.253.248.100NLAS213790 Limited Network LTD2026-09-2798
192.253.248.111NLAS213790 Limited Network LTD2026-09-0993
213.209.159.110DEAS208137 Feo Prest SRL2026-09-0973

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun050_00040017_976354f0same header set1.3K IPs18.7Kb11cun050_00040017_6b90553bsame header set1.3K IPs9.3Kb11cun050_00040017_e873236csame header set680 IPs6.1Kb11cun050_00040017_345c845bsame header set469 IPs2.6Kb11cun050_00040017_2015d6b2same header set524 IPs1.2Kb11cun050_00040017_91712619same header set1 IPs960b11cun050_00040017_ee17dab1same header set4 IPs660b11cun050_00040017_588d51acsame header set1 IPs610

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.