HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq070_00050835_c0b30902

Seen 2026-02-16 to 2026-10-07 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS51167 sends an email when it next hits a sensor.

202

Source IPs

118

Networks

45

Countries

2

Ports hit

14.1K

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS51167 Contabo GmbH11 IPs572
AS45102 Alibaba (US) Technology Co., Ltd.10 IPs607
AS31898 Oracle Corporation9 IPs490
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED7 IPs412
AS132203 Tencent Building, Kejizhongyi Avenue6 IPs307
AS36352 HostPapa5 IPs220
AS45090 Shenzhen Tencent Computer Systems Company Limited5 IPs218
AS150436 Byteplus Pte. Ltd.4 IPs261
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.4 IPs179
AS8560 IONOS SE4 IPs149
AS142403 YISU CLOUD LTD4 IPs76
AS8075 Microsoft Corporation3 IPs220

Countries

US 40SG 19CN 19FR 12VN 10IN 10ID 8DE 6HK 6SC 5

Ports targeted

443/tcp 7.8K80/tcp 6.3K

What it requests

POST/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh376
POST/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh365
POST/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input350
POST/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input342
GET/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php332
GET/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php328
GET/vendor/phpunit/src/Util/PHP/eval-stdin.php328
GET/vendor/phpunit/phpunit/LICENSE/eval-stdin.php327
GET/vendor/phpunit/Util/PHP/eval-stdin.php327
GET/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php326
GET/phpunit/phpunit/Util/PHP/eval-stdin.php324
GET/phpunit/src/Util/PHP/eval-stdin.php324

User agents claimed

libredtail-http202 IPs14.1K
Source IPCCNetwork Last seenEvents
87.192.253.110UZAS202660 Uzbektelekom Joint Stock Company2026-09-30572
103.46.186.85IDAS150462 PT Air Lintas Komunikasi2026-10-02484
31.132.90.3KZAS197556 Kar-Tel LLC2026-09-23410
103.46.186.148IDAS150462 PT Air Lintas Komunikasi2026-09-26396
223.123.65.54PKAS59257 CMPak Limited2026-10-06352
160.250.132.238VNAS150895 EZ TECHNOLOGY COMPANY LIMITED2026-10-06352
165.99.207.153PKAS45773 PERN AS Content Servie Provider, Islamabad, Pakistan2026-10-04308
186.182.105.49PYAS11664 Techtel LMDS Comunicaciones Interactivas S.A.2026-10-07308
102.244.97.185CMAS36912 Orange Cameroun SA2026-10-05308
103.63.101.24IDAS150273 PT Berkah Maju Interasional2026-10-04264
167.71.233.141INAS14061 DigitalOcean, LLC2026-10-07220
89.126.211.166UZAS202660 Uzbektelekom Joint Stock Company2026-10-07220
95.85.245.227EEAS209693 Oc Networks Limited2026-09-28176
37.120.213.13CHAS9009 M247 Europe SRL2026-09-25176
124.158.13.141VNAS38733 CMC Telecom Infrastructure Company2026-10-07176
95.130.227.78UZAS35682 Best Internet Solution Xk2026-09-24176
46.105.31.171FRAS16276 OVH SAS2026-09-30132
45.78.224.87SGAS150436 Byteplus Pte. Ltd.2026-10-07132
49.0.202.115SGAS136907 HUAWEI CLOUDS2026-10-05132
45.43.37.254TWAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-30132

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq060_00050815_9e42e2331 header apart2 IPs478b11cuq060_00050815_30319a111 header apart26 IPs66b11cuq060_00050815_c343dda91 header apart2 IPs11b11cun050_00040035_dd9050592 headers apart256 IPs1.8Kb11cuq070_00050817_ae8383eb2 headers apart75 IPs1.7Kb11cuq070_00050817_81cd65142 headers apart335 IPs1.3Kb11cuq070_00050817_9c017ed92 headers apart12 IPs238b11cuq050_00050805_650ae0b22 headers apart120 IPs164

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.