HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun050_0004001d_5cbb346f

Seen 2026-09-30 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS213412 sends an email when it next hits a sensor.

412

Source IPs

2

Networks

2

Countries

274

Ports hit

536

Events

206

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS213412 ONYPHE SAS410 IPs534
AS16276 OVH SAS2 IPs2

Countries

US 209FR 203

Ports targeted

17778/tcp 358000/tcp 252881/tcp 252230/tcp 251413/tcp 250070/tcp 233434/tcp 232400/tcp 232080/tcp 232015/tcp 228658/tcp 227017/tcp 2

What it requests

GET/274
GET/favicon.ico261
GET/SolarWinds/InformationService/v3/Json/Query1

User agents claimed

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0412 IPs536
Source IPCCNetwork Last seenEvents
195.184.76.123USAS213412 ONYPHE SAS2026-09-304
91.231.89.183FRAS213412 ONYPHE SAS2026-09-304
91.196.152.43FRAS213412 ONYPHE SAS2026-09-304
195.184.76.62USAS213412 ONYPHE SAS2026-09-304
195.184.76.231USAS213412 ONYPHE SAS2026-09-304
195.184.76.97USAS213412 ONYPHE SAS2026-09-303
195.184.76.104USAS213412 ONYPHE SAS2026-09-303
91.196.152.47FRAS213412 ONYPHE SAS2026-09-303
91.230.168.106USAS213412 ONYPHE SAS2026-09-303
91.196.152.165FRAS213412 ONYPHE SAS2026-09-303
91.196.152.151FRAS213412 ONYPHE SAS2026-09-303
195.184.76.0USAS213412 ONYPHE SAS2026-09-303
91.196.152.223FRAS213412 ONYPHE SAS2026-09-303
91.230.168.172USAS213412 ONYPHE SAS2026-09-303
91.230.168.41USAS213412 ONYPHE SAS2026-09-303
91.231.89.15FRAS213412 ONYPHE SAS2026-09-303
91.196.152.201FRAS213412 ONYPHE SAS2026-09-303
195.184.76.238USAS213412 ONYPHE SAS2026-09-303
195.184.76.124USAS213412 ONYPHE SAS2026-09-303
195.184.76.15USAS213412 ONYPHE SAS2026-09-302

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun060_0004003d_f55b17ef1 header apart2 IPs1.4Kb11cun060_0004001f_d170ef011 header apart5 IPs300b11cun040_00040015_4c87b06e1 header apart3 IPs43b11cun060_0004001f_eefe52101 header apart1 IPs12b11cun060_0006001d_3af976da1 header apart10 IPs10b11cun040_00040015_00b09b791 header apart1 IPs9b11cun040_00040015_ba1829311 header apart1 IPs8b11cun060_0004001f_561f323a1 header apart3 IPs6

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.