HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

b11cuq080_10050c13_37cee2c0

Seen 2026-04-02 to 2026-09-30 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

1

Source IPs

1

Networks

1

Countries

1

Ports hit

38

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS48090 Techoff Srv Limited1 IPs38

Countries

BG 1

Ports targeted

443/tcp 38

What it requests

POST/6
POST/j_security_check4
POST/login2
POST/app2
POST/Login2
POST/goform/setmac2
POST/two_fact_auth2
POST/api/login2
POST/wp-admin/admin-ajax.php2
POST/flexnet/logon.do2
POST/cgi-bin/login.cgi2
POST/controller/ping.php2

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.01 IPs2
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.151 IPs1
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.361 IPs1
Mozilla/5.0 (Macintosh; arm64 Mac OS X 12_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.151 IPs1
Mozilla/5.0 (Windows; U; Windows NT 6.1; ja-JP) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.41 IPs1
Source IPCCNetwork Last seenEvents
93.123.109.214BGAS48090 Techoff Srv Limited2026-09-3038

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq070_00050c13_aee6d12e1 header apart2 IPs40b11cuq060_00050813_95cc9d022 headers apart54 IPs3.1Kb11cuq080_10050c16_b8c2c87d2 headers apart24 IPs1.0Kb11cuq060_00050813_8587a3e32 headers apart4 IPs107b11cuq060_10050812_0421ce222 headers apart4 IPs51b11cuq100_10050c1f_aee5fe3f2 headers apart3 IPs8b11cuq100_10050c1f_fbf50a1e2 headers apart3 IPs4

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.