HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun051_00040016_1ad00147_x7585

Seen 2026-08-10 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS8075 sends an email when it next hits a sensor.

5

Source IPs

1

Networks

1

Countries

2

Ports hit

5

Events

5

IPs / network

Top networks

AS8075 Microsoft Corporation5 IPs5

Countries

US 5

Ports targeted

80/tcp 3502/tcp 2

What it requests

GET/4
GET/manual1

User agents claimed

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.365 IPs5
Source IPCCNetwork Last seenEvents
52.167.144.196USAS8075 Microsoft Corporation2026-10-011
52.167.144.150USAS8075 Microsoft Corporation2026-09-251
40.77.167.156USAS8075 Microsoft Corporation2026-09-251
40.77.167.58USAS8075 Microsoft Corporation2026-10-011
52.167.144.206USAS8075 Microsoft Corporation2026-09-181

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040016_aa48e2c81 header apart5.4K IPs476.3Kb11cun040_00040016_4110f1561 header apart314 IPs131.4Kb11cun040_00040016_c1d300831 header apart56 IPs13.3Kb11cun040_00040016_9e0aeda71 header apart51 IPs9.1Kb11cun040_00040016_c5bb04c51 header apart124 IPs6.7Kb11cun040_00040016_f36dd82e1 header apart9 IPs6.4Kb11cun040_00040016_fb5231471 header apart26 IPs1.3Kb11cun040_00040016_50f908881 header apart70 IPs1.2K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.