HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq070_00050835_c0b30902

Seen 2026-02-16 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

223

Source IPs

126

Networks

45

Countries

2

Ports hit

14.6K

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.14 IPs780
AS51167 Contabo GmbH12 IPs704
AS31898 Oracle Corporation10 IPs710
AS45090 Shenzhen Tencent Computer Systems Company Limited7 IPs235
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED6 IPs498
AS137718 Beijing Volcano Engine Technology Co., Ltd.5 IPs141
AS16276 OVH SAS4 IPs264
AS8075 Microsoft Corporation4 IPs220
AS36352 HostPapa4 IPs176
AS8560 IONOS SE4 IPs155
AS132203 Tencent Building, Kejizhongyi Avenue4 IPs146
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.4 IPs144

Countries

US 41CN 27SG 19FR 18VN 15IN 11DE 8HK 8ID 7NL 5

Ports targeted

443/tcp 8.0K80/tcp 6.6K

What it requests

POST/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh390
POST/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh377
POST/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input362
POST/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input355
GET/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php343
GET/vendor/phpunit/src/Util/PHP/eval-stdin.php339
GET/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php339
GET/vendor/phpunit/phpunit/LICENSE/eval-stdin.php338
GET/vendor/phpunit/Util/PHP/eval-stdin.php338
GET/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php336
GET/phpunit/phpunit/src/Util/PHP/eval-stdin.php334
GET/phpunit/phpunit/Util/PHP/eval-stdin.php334

User agents claimed

libredtail-http223 IPs14.6K
Source IPCCNetwork Last seenEvents
87.192.253.110UZAS202660 Uzbektelekom Joint Stock Company2026-09-28704
31.132.90.3KZAS197556 Kar-Tel LLC2026-09-23615
103.46.186.148IDAS150462 PT Air Lintas Komunikasi2026-09-26440
223.123.65.54PKAS59257 CMPak Limited2026-09-27396
103.46.186.85IDAS150462 PT Air Lintas Komunikasi2026-09-27352
95.85.245.227EEAS209693 Oc Networks Limited2026-09-28264
45.43.37.254TWAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-30220
165.99.207.153PKAS45773 PERN AS Content Servie Provider, Islamabad, Pakistan2026-09-28220
160.250.132.238VNAS150895 EZ TECHNOLOGY COMPANY LIMITED2026-09-28220
95.173.161.147TRAS51559 Netinternet Bilisim Teknolojileri AS2026-09-09205
95.130.227.78UZAS35682 Best Internet Solution Xk2026-09-24176
160.187.247.119VNAS150862 VPSTTT COMPUTER COMPANY LIMITED2026-09-20176
107.150.97.10USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-25176
124.158.13.4VNAS38733 CMC Telecom Infrastructure Company2026-09-20176
167.71.233.141INAS14061 DigitalOcean, LLC2026-09-29176
103.63.101.24IDAS150273 PT Berkah Maju Interasional2026-09-25176
37.120.213.13CHAS9009 M247 Europe SRL2026-09-25176
138.2.102.66SGAS31898 Oracle Corporation2026-09-08176
223.123.92.77PKAS59257 CMPak Limited2026-09-05132
171.244.14.216VNAS38731 CHT Compamy Ltd2026-09-08132

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq060_00050815_9e42e2331 header apart14 IPs490b11cuq060_00050815_a38e1c5d1 header apart1 IPs336b11cuq060_00050815_30319a111 header apart23 IPs61b11cuq060_00050815_c1fcf7351 header apart1 IPs21b11cuq060_00050815_c343dda91 header apart2 IPs11b11cdq080_00050815_7f3455531 header apart1 IPs4b11cun050_00040035_dd9050592 headers apart277 IPs1.8Kb11cuq070_00050817_81cd65142 headers apart301 IPs1.2K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.