HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq050_00050812_107c8b82

Seen 2026-02-17 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS398324 sends an email when it next hits a sensor.

97

Source IPs

19

Networks

9

Countries

16

Ports hit

628

Events

5

IPs / network

Top networks

AS398324 Censys, Inc.39 IPs82
AS398722 Censys, Inc.14 IPs28
AS396982 Google LLC10 IPs307
AS398705 Censys, Inc.10 IPs32
AS8075 Microsoft Corporation8 IPs21
AS219502 Storm Industries LLC3 IPs78
AS215925 Vpsvault.host Ltd2 IPs41
Unattributed1 IPs9
AS43180 Trunk Networks LTD1 IPs5
AS197170 TechTies Inc.1 IPs5
AS13335 Cloudflare, Inc.1 IPs4
AS26496 GoDaddy.com, LLC1 IPs4

Countries

US 79DE 5SG 4NL 3JP 2CA 1BE 1SC 1MY 1

Ports targeted

443/tcp 2928545/tcp 1424096/tcp 758088/tcp 418080/tcp 2780/tcp 102087/tcp 89999/tcp 87860/tcp 69308/tcp 411434/tcp 43000/tcp 3

What it requests

POST/147
POST/session76
POST/ws/v1/cluster/apps/new-application41
POST/read-document28
POST/api/designer/v1/file-content28
POST/api/templates/preview28
POST/feast/read-document24
POST/api/v1/validate/code21
POST/___proxy_subdomain_whm/login/?login_only=118
POST/lib/terminal-xhr.php15
POST/icecoder/lib/terminal-xhr.php15
POST/api/fs/exec14

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)63 IPs142
Go-http-client/1.16 IPs133
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot8 IPs17
Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)8 IPs13
Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)7 IPs13
Source IPCCNetwork Last seenEvents
94.154.43.7NLAS219502 Storm Industries LLC2026-09-2984
34.89.245.228DEAS396982 Google LLC2026-09-2954
35.187.246.147SGAS396982 Google LLC2026-09-2950
136.90.54.131USAS396982 Google LLC2026-09-2832
45.198.224.158USAS215925 Vpsvault.host Ltd2026-09-2826
34.95.4.198CAAS396982 Google LLC2026-09-2925
35.198.131.152DEAS396982 Google LLC2026-09-2925
35.221.64.237JPAS396982 Google LLC2026-09-2925
34.124.215.33SGAS396982 Google LLC2026-09-3025
34.84.217.48JPAS396982 Google LLC2026-09-2925
207.175.110.40BEAS396982 Google LLC2026-09-2925
136.90.15.166USAS396982 Google LLC2026-09-2921
45.198.224.188USAS215925 Vpsvault.host Ltd2026-09-2515
167.94.146.51USAS398705 Censys, Inc.2026-09-226
91.92.47.116NLAS197170 TechTies Inc.2026-09-155
85.137.51.115SGAS43180 Trunk Networks LTD2026-09-035
104.28.207.218DEAS13335 Cloudflare, Inc.2026-09-304
148.66.133.23SGAS26496 GoDaddy.com, LLC2026-09-054
167.94.146.52USAS398705 Censys, Inc.2026-09-214
66.132.172.196USAS398324 Censys, Inc.2026-09-154

Fingerprint family: 3 shapes, 97 IPs, 737 events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 5 headers, Content-Length body: accept-encoding, user-agent, content-length, content-type, host

asks for/ · /session · /ws/v1/cluster/apps/new-application · /api/designer/v1/file-content (POST)
asMozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) · Go-http-client/1.1 · Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like and 99 more
ports443 · 8545 · 4096 · 8088
fromUS · DE · NL · SG · Google LLC · Censys, Inc. · Storm Industries LLC
b11cuq050_00050812_107c8b82 this oneMozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) · /97 IPs628b11cuq082_00050816_8184102b_xd0f1e7f3+/- accept, next-action, x-middleware-subrequest · Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/) · /10 IPs81b11cuq061_00050812_0421ce22_x48ab+/- spring.cloud.function.routing-expression · Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/) · /functionRouter10 IPs28
All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq050_00050812_48bb8ee9same header set2 IPs48b11cuq050_00050812_e41ea0b6same header set1 IPs4b11cuq060_00050813_95cc9d021 header apart55 IPs3.1Kb11cuq060_00050816_84d4cebf1 header apart324 IPs554b11cuq060_00050816_8092f7131 header apart4 IPs125b11cuq060_00050813_8587a3e31 header apart4 IPs107b11cuq040_00040812_cfad16f71 header apart24 IPs93b11cuq040_00050802_cfad16f71 header apart1 IPs68

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.