HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun060_0004041e_34325780

Seen 2026-02-16 to 2026-09-29 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS12876 sends an email when it next hits a sensor.

13

Source IPs

1

Networks

2

Countries

7

Ports hit

13

Events

13

IPs / network

Top networks

AS12876 Scaleway SAS13 IPs13

Countries

PL 7FR 6

Ports targeted

443/tcp 34153/tcp 31080/tcp 25678/tcp 23128/tcp 18080/tcp 18085/tcp 1

What it requests

GET/favicon.ico13

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.313 IPs13
Source IPCCNetwork Last seenEvents
51.159.107.12FRAS12876 Scaleway SAS2026-09-081
151.115.99.198PLAS12876 Scaleway SAS2026-09-091
151.115.90.240PLAS12876 Scaleway SAS2026-09-251
151.115.90.238PLAS12876 Scaleway SAS2026-09-111
62.210.198.206FRAS12876 Scaleway SAS2026-09-231
151.115.100.30PLAS12876 Scaleway SAS2026-09-171
51.159.194.98FRAS12876 Scaleway SAS2026-09-121
151.115.99.180PLAS12876 Scaleway SAS2026-09-161
151.115.99.174PLAS12876 Scaleway SAS2026-09-291
51.158.37.13FRAS12876 Scaleway SAS2026-09-261
62.210.198.215FRAS12876 Scaleway SAS2026-09-111
51.159.213.101FRAS12876 Scaleway SAS2026-09-281
151.115.100.39PLAS12876 Scaleway SAS2026-09-061

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun060_0004041e_3d0e68c3same header set5 IPs278b11cun050_0004001e_a647ba7f1 header apart27 IPs146.7Kb11cun050_0004001e_5f8868581 header apart562 IPs34.5Kb11cun050_0004001e_00ecc3a81 header apart83 IPs3.7Kb11cun050_0004001e_377ad04d1 header apart113 IPs271b11cun050_0004001e_d490606f1 header apart76 IPs190b11cun050_0004001e_b55602bc1 header apart10 IPs115b11cun050_0004001e_0c87f8d11 header apart8 IPs32

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.