Akin HTTP request fingerprint

b10cun041_00040014_8cf638c8_x518b

Seen 2026-03-08 to 2026-10-10 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS137409 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

252

Ports hit

524

Events

IPs / network

Top networks

AS137409 GSL Networks Pty LTD6 IPs11

AS58224 Iran Telecommunication Company PJS2 IPs2

AS40021 Contabo Inc.1 IP501

AS8075 Microsoft Corporation1 IP7

AS12389 Rostelecom1 IP3

Countries

US 8IR 2RU 1

Ports targeted

3128/tcp 11 10001/tcp 5 10000/tcp 5 1000/tcp 4 10002/tcp 4 8080/tcp 4 60000/tcp 3 10003/tcp 3 1180/tcp 3 1126/tcp 2 1190/tcp 2 1071/tcp 2

What it requests

GEThttp://www.google.com/524

User agents claimed

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)11 IPs524

Source IPCCNetwork Last seenEvents

147.93.2.57USAS40021 Contabo Inc.2026-10-01501

20.172.204.31USAS8075 Microsoft Corporation2026-09-297

45.74.17.182USAS137409 GSL Networks Pty LTD2026-09-233

176.50.71.134RUAS12389 Rostelecom2026-09-273

45.74.17.120USAS137409 GSL Networks Pty LTD2026-10-072

45.74.17.70USAS137409 GSL Networks Pty LTD2026-10-062

45.74.17.76USAS137409 GSL Networks Pty LTD2026-10-052

217.218.30.110IRAS58224 Iran Telecommunication Company PJS2026-10-021

217.218.31.23IRAS58224 Iran Telecommunication Company PJS2026-10-021

45.74.17.107USAS137409 GSL Networks Pty LTD2026-10-101

45.74.17.252USAS137409 GSL Networks Pty LTD2026-10-081

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun041_00040014_6e8c246c_x518bsame header set2 IPs100 b11cun030_00040014_03330a181 header apart146 IPs938.5K b11cun030_00040014_54d07b6d1 header apart3.7K IPs43.9K b10cun030_00040014_54d07b6d1 header apart49 IPs296 b11cun030_00040014_eb31c4e41 header apart42 IPs45 b11cun030_00040014_0a7734321 header apart42 IPs42 b11cun031_00040010_e62b6d85_x518b1 header apart3 IPs26 b10cun020_00000014_0a8d7f112 headers apart2.0K IPs486.5K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.