HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq070_00050817_3826af57

Seen 2026-08-23 to 2026-09-18 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS63835 sends an email when it next hits a sensor.

1

Source IPs

1

Networks

1

Countries

14

Ports hit

538

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS63835 No.293,Wanbao Avenue1 IPs538

Countries

CN 1

Ports targeted

8000/tcp 848080/tcp 833000/tcp 7611434/tcp 601337/tcp 517860/tcp 48100/tcp 243001/tcp 248188/tcp 245000/tcp 168888/tcp 164891/tcp 12

What it requests

POST/v1/chat/completions50
POST/v1/completions34
POST/v1/audio/transcriptions18
POST/v1/images/edits18
POST/v1/images/generations18
POST/v1/fine_tuning/jobs18
POST/v1/audio/translations18
POST/v1/audio/speech18
POST/v1/images/variations18
POST/v1/moderations17
POST/v1/embeddings17
POST/16

User agents claimed

llm-scan-zgrab2/0.11 IPs538
Source IPCCNetwork Last seenEvents
175.6.54.250CNAS63835 No.293,Wanbao Avenue2026-09-18538

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq070_00050817_81cd6514same header set301 IPs1.2Kb11cuq070_00050817_68b419c1same header set1 IPs480b11cuq070_00050817_9c017ed9same header set12 IPs231b11cuq070_00050817_9f8bde3dsame header set11 IPs51b11cuq070_00050817_bad9ef97same header set18 IPs36b11cuq070_00050817_ae8383ebsame header set2 IPs29b11cuq070_00050817_af581401same header set1 IPs28b11cuq070_00050817_fdd8f8c3same header set7 IPs21

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.