HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun060_0004001f_eefe5210

Seen 2026-02-17 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

19

Source IPs

3

Networks

4

Countries

14

Ports hit

5.8K

Events

6

IPs / network

Top networks

AS14061 DigitalOcean, LLC16 IPs114
AS63949 Akamai Connected Cloud2 IPs23
AS48090 Techoff Srv Limited1 IPs5.7K

Countries

US 16BG 1DE 1JP 1

Ports targeted

443/tcp 5.7K8000/tcp 162087/tcp 128160/tcp 129000/tcp 129200/tcp 12444/tcp 88443/tcp 880/tcp 74443/tcp 78080/tcp 610443/tcp 6

What it requests

GET/349
GET/ui/login/56
GET/ui/favicon.ico55
GET/miscadmin24
GET/.env21
GET/?rest_route=/wp/v2/users12
GET/wp-json/wp/v2/users12
GET/login.rst12
GET/admin12
GET/login12
GET/.../.../.../.../.../.../.../.../.../windows/win.ini9
GET/.env.development.local9

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.152 IPs15
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.151 IPs15
Mozilla/5.0 (Windows NT 10.0; rv:140.0) Gecko/20100101 Firefox/140.01 IPs15
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; ja-jp) AppleWebKit/523.12.2 (KHTML, like Gecko) Version/3.0.4 Safari/523.12.21 IPs14
Mozilla/5.0 (Windows NT 10.0: Win64: x64: rv:140.0) Gecko/20100101 Firefox/140.01 IPs14
Source IPCCNetwork Last seenEvents
93.123.109.214BGAS48090 Techoff Srv Limited2026-10-015.7K
139.162.144.170DEAS63949 Akamai Connected Cloud2026-09-1321
162.243.36.61USAS14061 DigitalOcean, LLC2026-09-0216
162.243.215.136USAS14061 DigitalOcean, LLC2026-09-0214
107.170.1.93USAS14061 DigitalOcean, LLC2026-09-0214
162.243.244.137USAS14061 DigitalOcean, LLC2026-09-0212
107.170.27.160USAS14061 DigitalOcean, LLC2026-09-0212
162.243.45.22USAS14061 DigitalOcean, LLC2026-09-0212
162.243.209.212USAS14061 DigitalOcean, LLC2026-09-0210
107.170.47.172USAS14061 DigitalOcean, LLC2026-09-026
162.243.77.132USAS14061 DigitalOcean, LLC2026-09-025
162.243.26.244USAS14061 DigitalOcean, LLC2026-09-024
107.170.40.5USAS14061 DigitalOcean, LLC2026-09-022
172.233.74.26JPAS63949 Akamai Connected Cloud2026-09-022
107.170.70.148USAS14061 DigitalOcean, LLC2026-09-022
162.243.243.92USAS14061 DigitalOcean, LLC2026-09-022
165.22.32.66USAS14061 DigitalOcean, LLC2026-09-111
157.245.7.192USAS14061 DigitalOcean, LLC2026-09-111
104.236.225.50USAS14061 DigitalOcean, LLC2026-09-111

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun060_0004001f_d170ef01same header set16 IPs37.5Kb11cun060_0004001f_7d5e642bsame header set450 IPs2.8Kb11cun060_0004001f_b9768d0esame header set2 IPs2.3Kb11cun060_0004001f_9b6188bfsame header set29 IPs1.3Kb11cun060_0004001f_e609a46csame header set311 IPs852b11cun060_0004001f_561f323asame header set157 IPs587b11cun060_0004001f_9dee14a7same header set3 IPs144b11cun060_0004001f_efc53d1esame header set5 IPs55

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.