HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq040_00040814_6e8c246c

Seen 2026-05-16 to 2026-09-28 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

2

Source IPs

1

Networks

1

Countries

2

Ports hit

12

Events

2

IPs / network

Top networks

AS48090 Techoff Srv Limited2 IPs12

Countries

BG 2

Ports targeted

80/tcp 8443/tcp 4

What it requests

POST/?page_id=9034321
POST/?page_id=9033041
POST/?page_id=9066611
POST/?page_id=9042771
POST/?page_id=9017941
POST/?page_id=9000611
POST/?page_id=9064381
POST/?page_id=9053681
POST/?page_id=9050181
POST/?page_id=9088661
POST/?page_id=9068431
POST/?page_id=9081981

User agents claimed

cve-2026-87902-poc/1.02 IPs12
Source IPCCNetwork Last seenEvents
195.178.110.247BGAS48090 Techoff Srv Limited2026-09-288
195.178.110.22BGAS48090 Techoff Srv Limited2026-09-264

Fingerprint family: 2 shapes, 3.7K IPs, 135.9K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 3 headers, no body: accept, user-agent, host

asks for/ · /favicon.ico · /selfupdate/wuident.cab · /v1/models (GET / HEAD)
asMozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like · curl/7.29.0 · curl/7.64.1 and 151 more
ports80 · 443 · 8161 · 9200
fromNL · US · HK · TH · Techoff Srv Limited · UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT · Alibaba (US) Technology Co., Ltd.
b11cun030_00040014_54d07b6dMozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like · /3.7K IPs135.9Kb11cuq040_00040814_6e8c246c this one+/- content-length · cve-2026-87902-poc/1.0 · /?page_id=9081982 IPs12
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun030_00040014_03330a181 header apart3.9K IPs1.4Mb11cun030_00040014_54d07b6d1 header apart3.7K IPs135.9Kb10cun030_00040014_54d07b6d1 header apart53 IPs528b11cuq030_00040810_e62b6d851 header apart19 IPs496b11cun030_00040014_e29c64ac1 header apart1 IPs80b11cuq050_00050814_6eb31df91 header apart52 IPs74b11cun030_00040014_a626bc271 header apart1 IPs66b11cun030_00040014_0a7734321 header apart38 IPs39

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.