HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun063_40040001_ffe60107_x9f62a4acfdb1

Seen 2026-05-06 to 2026-09-22 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS399629 sends an email when it next hits a sensor.

6

Source IPs

2

Networks

3

Countries

9

Ports hit

44

Events

3

IPs / network

Top networks

AS399629 BL Networks5 IPs38
AS396356 Latitude.sh1 IPs6

Countries

US 3SG 2RO 1

Ports targeted

8080/tcp 8443/tcp 65173/tcp 68443/tcp 680/tcp 41337/tcp 48888/tcp 411601/tcp 431337/tcp 2

What it requests

GET/41
GET/?token=probe3
Source IPCCNetwork Last seenEvents
72.5.43.15ROAS399629 BL Networks2026-09-1916
162.33.179.171USAS399629 BL Networks2026-09-1710
64.34.81.199USAS396356 Latitude.sh2026-09-206
66.179.31.143SGAS399629 BL Networks2026-09-224
69.48.229.164SGAS399629 BL Networks2026-09-224
216.245.184.242USAS399629 BL Networks2026-09-174

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun073_40040011_cfe69652_x9f62a4acfdb11 header apart12 IPs548b11cun052_40040001_985b9497_x9f62fdb11 header apart28 IPs35b11cun052_40040001_96308994_x9f62fdb11 header apart7 IPs16b11cun062_40040011_ffe60107_x9f62fdb12 headers apart85 IPs1.1Kb11cun083_50040011_966c00f7_x9f62a4acfdb12 headers apart4 IPs517b11cun084_40040011_966c00f7_x12be9f62a4acfdb12 headers apart2 IPs216b11cun062_50040001_ffe60107_x9f62fdb12 headers apart1 IPs1

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.