Akin HTTP request fingerprint

a11cun060_0000005f_2ef3966d

Seen 2026-09-28 to 2026-09-28 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

346

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS48090 Techoff Srv Limited1 IPs346

Countries

BG 1

Ports targeted

443/tcp 346

What it requests

GET/miscadmin8

GET/wp-json/wp/v2/users4

GET/.env4

GET/?rest_route=/wp/v2/users4

GET/.env.prod.local3

GET/.env.stage3

GET/.env.local3

GET/.env.dev.local3

GET/.env_sample3

GET/.env.old3

GET/.env.live3

GET/.env.development.local3

User agents claimed

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; ja-jp) AppleWebKit/523.12.2 (KHTML, like Gecko) Version/3.0.4 Safari/523.12.21 IPs3

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.361 IPs3

Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.91 IPs3

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.271 IPs3

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.01 IPs3

Source IPCCNetwork Last seenEvents

93.123.109.214BGAS48090 Techoff Srv Limited2026-09-28346

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun060_0000005f_d170ef01same header set7 IPs6.4K a11cun060_0000005f_521e1e4esame header set1 IPs1.6K a11cun060_0000005f_720361ccsame header set2 IPs1.0K a11cun060_0000005f_7d5e642bsame header set179 IPs940 a11cun060_0000005f_3e751395same header set129 IPs360 a11cun060_0000005f_fc0644f8same header set152 IPs338 a11cun060_0000005f_4dbae000same header set17 IPs229 a11cun060_0000005f_a83fa1e6same header set1 IPs63

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.