Akin HTTP request fingerprint

b10cun040_00040015_4c87b06e

Seen 2026-05-10 to 2026-10-01 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14956 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

138

Ports hit

1.4K

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS14956 RouterHosting LLC4 IPs420

AS396356 Latitude.sh4 IPs9

AS219502 Storm Industries LLC3 IPs719

Unattributed2 IPs82

AS51847 Nearoute Limited1 IPs125

AS17816 China Unicom IP network China169 Guangdong province1 IPs28

AS36352 HostPapa1 IPs12

AS56971 Cgi Global Limited1 IPs8

AS4766 Korea Telecom1 IPs4

Countries

US 10NL 3JP 1CN 1KR 1

Ports targeted

80/tcp 85 51821/tcp 71 8080/tcp 58 5001/tcp 54 8443/tcp 49 8069/tcp 47 8001/tcp 46 8081/tcp 45 3128/tcp 45 8070/tcp 43 2095/tcp 43 2052/tcp 43

What it requests

GET/805

GEThttp://azenv.net/486

GET/api/session71

GET/manifest.json30

GET/favicon.ico6

GET/api/stats6

GET/api/onboarding2

GEThttp://icanhazip.com/1

User agents claimed

Mozilla/5.02 IPs487

zern-scanner (+https://zern.io)4 IPs420

odin-scanner/0.42 IPs322

Mozilla/5.0 (Windows NT 10.0; Win64; x64)2 IPs146

frigate-hunter/2.01 IPs12

Source IPCCNetwork Last seenEvents

94.154.43.31NLAS219502 Storm Industries LLC2026-10-01479

94.154.43.60NLAS219502 Storm Industries LLC2026-10-01273

216.126.239.150USAS14956 RouterHosting LLC2026-09-15245

216.126.239.163USAS14956 RouterHosting LLC2026-09-28148

38.207.136.30JPAS51847 Nearoute Limited2026-09-25125

94.154.43.105NLAS219502 Storm Industries LLC2026-09-1249

157.122.171.126CNAS17816 China Unicom IP network China169 Guangdong province2026-09-2528

216.126.239.185USAS14956 RouterHosting LLC2026-09-2424

192.210.137.238USAS36352 HostPapa2026-09-1712

31.59.40.122USAS56971 Cgi Global Limited2026-09-138

136.144.43.236USAS396356 Latitude.sh2026-09-156

220.126.240.110KRAS4766 Korea Telecom2026-09-184

216.126.227.184USAS14956 RouterHosting LLC2026-09-133

136.144.43.218USAS396356 Latitude.sh2026-09-151

173.239.224.240USAS396356 Latitude.sh2026-09-151

136.144.43.231USAS396356 Latitude.sh2026-09-151

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040015_4c87b06esame header set1.5K IPs153.0K b11cun040_00040015_00b09b79same header set4 IPs3.0K b11cun040_00040015_a4cdfabfsame header set31 IPs583 b11cun040_00040015_5cd6f744same header set2 IPs340 b11cun040_00040015_ba182931same header set6 IPs152 b11cun040_00040015_d76a48e1same header set3 IPs104 b11cun040_00040015_b03a935bsame header set3 IPs64 b11cun040_00040015_f0265a0esame header set34 IPs34

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.