HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq050_00050811_985b9497

Seen 2026-03-15 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS55577 sends an email when it next hits a sensor.

7

Source IPs

6

Networks

5

Countries

5

Ports hit

66

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS55577 Atria Convergence Technologies Ltd.,2 IPs6
AS14080 Telmex Colombia S.A.1 IPs43
AS202412 Omegatech LTD1 IPs10
AS4134 Chinanet1 IPs3
AS215925 Vpsvault.host Ltd1 IPs2
AS206264 Amarutu Technology Ltd1 IPs2

Countries

NL 2IN 2CO 1CN 1US 1

Ports targeted

80/tcp 485678/tcp 108080/tcp 38081/tcp 38088/tcp 2

What it requests

POST/boaform/admin/formLogin43
POST/action/setDebugCfg/.txt9
POST/rest/workflows8
POST/rest/login2
POST/cgi-bin/main-cgi2
POST/ws/v1/cluster/apps/new-application2

User agents claimed

Mozilla/5.04 IPs52
Go-http-client/1.12 IPs12
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.361 IPs2
Source IPCCNetwork Last seenEvents
190.159.36.43COAS14080 Telmex Colombia S.A.2026-09-2043
130.12.180.42NLAS202412 Omegatech LTD2026-09-2110
49.207.2.143INAS55577 Atria Convergence Technologies Ltd.,2026-09-043
124.123.42.109INAS55577 Atria Convergence Technologies Ltd.,2026-09-083
121.205.66.220CNAS4134 Chinanet2026-09-203
45.198.224.158USAS215925 Vpsvault.host Ltd2026-09-302
89.42.231.200NLAS206264 Amarutu Technology Ltd2026-09-052

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq050_00050811_9b8c433asame header set7 IPs153b11cuq040_00040811_2daa70d61 header apart237 IPs6.4Kb11cuq060_02050811_e545b78f1 header apart114 IPs5.7Kb11cuq060_00050813_95cc9d021 header apart55 IPs3.1Kb11cuq060_04050811_ffe601071 header apart140 IPs1.3Kb11cuq040_00050801_2daa70d61 header apart93 IPs659b11cuq060_00050815_9e42e2331 header apart14 IPs490b11cuq060_00050815_a38e1c5d1 header apart1 IPs336

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.