HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun062_00040016_84d4cebf_x45448512

Seen 2026-08-16 to 2026-09-17 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

38

Source IPs

5

Networks

8

Countries

19

Ports hit

19.8K

Events

8

IPs / network

Top networks

AS396982 Google LLC25 IPs18.7K
AS14618 Amazon.com, Inc.6 IPs426
AS199524 G-Core Labs S.A.3 IPs354
AS24940 Hetzner Online GmbH3 IPs213
AS18978 Enzu Inc1 IPs142

Countries

US 21NL 5TW 4DE 3BE 2SG 1JP 1FI 1

Ports targeted

8443/tcp 1.7K8000/tcp 1.6K443/tcp 1.6K5173/tcp 1.5K9090/tcp 1.5K9443/tcp 1.5K5000/tcp 1.3K8888/tcp 1.2K80/tcp 1.1K8081/tcp 1.1K3000/tcp 1.0K2375/tcp 1.0K

What it requests

GET/fetch?url=file%3A%2F%2F%2Fproc%2Fself%2Fenviron283
GET/fetch?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F283
GET/fetch?url=http%3A%2F%2F169.254.169.254%2Fmetadata%2Fidentity%2Foauth2%2Ftoken%3Fapi-version%3D2018-02-01%26resource%3Dhttps%3A%2F%2Fcognitiveservices.azure.com%2F283
GET/api/proxy?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F282
GET/proxy?url=http%3A%2F%2F169.254.169.254%2Fmetadata%2Fidentity%2Foauth2%2Ftoken%3Fapi-version%3D2018-02-01%26resource%3Dhttps%3A%2F%2Fcognitiveservices.azure.com%2F282
GET/proxy?url=file%3A%2F%2F%2Froot%2F.aws%2Fcredentials282
GET/redirect?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F282
GET/proxy?url=file%3A%2F%2F%2Fproc%2Fself%2Fenviron282
GET/api/fetch?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F282
GET/api/webhook?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F282
GET/api/webhook?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F282
GET/fetch?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F281

User agents claimed

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)24 IPs282
Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)25 IPs268
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot)25 IPs264
Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)25 IPs263
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)24 IPs254
Source IPCCNetwork Last seenEvents
8.229.251.12USAS396982 Google LLC2026-09-121.1K
34.158.109.130NLAS396982 Google LLC2026-09-131.1K
34.125.130.62USAS396982 Google LLC2026-09-041.1K
34.90.223.23NLAS396982 Google LLC2026-09-071.1K
35.240.163.160SGAS396982 Google LLC2026-09-021.1K
34.77.20.113BEAS396982 Google LLC2026-09-111.1K
34.81.32.10TWAS396982 Google LLC2026-09-061.1K
34.146.34.97JPAS396982 Google LLC2026-09-011.1K
34.182.164.122USAS396982 Google LLC2026-09-12994
8.228.19.130USAS396982 Google LLC2026-09-14994
34.34.151.241BEAS396982 Google LLC2026-09-11994
34.21.89.109USAS396982 Google LLC2026-09-05967
34.13.160.68NLAS396982 Google LLC2026-09-05923
34.16.206.147USAS396982 Google LLC2026-09-05889
34.34.109.114NLAS396982 Google LLC2026-09-06852
34.125.199.35USAS396982 Google LLC2026-09-15568
34.186.9.165USAS396982 Google LLC2026-08-31497
34.24.97.217USAS396982 Google LLC2026-09-05426
34.81.215.134TWAS396982 Google LLC2026-09-03426
34.74.135.191USAS396982 Google LLC2026-09-05426

Fingerprint family: 3 shapes, 38 IPs, 170.5K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 6 headers, no body, 2 outside the core list: accept-encoding, accept, user-agent, host, metadata, metadata-flavor

asks for/ · /app/api/.env · /access_keys.csv · /horizon/dashboard (GET)
asMozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity- · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1 and 80843 more
ports8000 · 9090 · 5173 · 443
fromUS · NL · BE · TW · Google LLC · Iic Rail Limited · Pfcloud UG (haftungsbeschrankt)
b11cun062_00040016_84d4cebf_x45448512 this oneMozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot) · /api/image?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-38 IPs19.8Kb11cun040_00040016_f8a95cc6+/- metadata, metadata-flavor · vitesweep/1 · /29 IPs330b11cun050_0004001e_a647ba7f+/- accept-language, metadata, metadata-flavor · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1 · /28 IPs150.4K
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun051_00040016_3a5e65e0_x85121 header apart1 IPs5b11cun051_00040016_3a5e65e0_x45441 header apart1 IPs2b11cun040_00040016_aa48e2c82 headers apart6.2K IPs527.8Kb11cun040_00040016_4110f1562 headers apart261 IPs172.7Kb11cun040_00040016_9e0aeda72 headers apart51 IPs8.4Kb11cun040_00040016_c1d300832 headers apart48 IPs6.4Kb11cun040_00040016_f36dd82e2 headers apart9 IPs5.5Kb11cun040_00040016_c5bb04c52 headers apart65 IPs3.6K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.