Akin HTTP request fingerprint

b11cun020_00040001_4e1a3733

Seen 2026-02-17 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS36352 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

186

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS36352 HostPapa2 IPs83

AS202412 Omegatech LTD2 IPs78

AS140293 CHINATELECOM Jiangsu province Changzhou 5G network2 IPs8

AS397423 Tier.Net Technologies LLC1 IPs7

AS8075 Microsoft Corporation1 IPs4

AS401626 Netiface America, Inc.1 IPs3

AS51396 Pfcloud UG (haftungsbeschrankt)1 IPs2

AS7922 Comcast Cable Communications, LLC1 IPs1

Countries

US 6CN 2DE 1KR 1NL 1

Ports targeted

8642/tcp 65 9119/tcp 13 11111/tcp 6 443/tcp 6 10443/tcp 6 8443/tcp 6 8000/tcp 4 11434/tcp 4 999/tcp 4 2443/tcp 4 4433/tcp 3 1443/tcp 3

What it requests

GET/139

GET/RDWeb/Pages/en-US/login.aspx28

GEThttp://httpbin.org/ip7

GET/api/tags4

GET/v1/models4

GET/openid_connect/cpanelid3

GET/api/v1/auto_login1

Source IPCCNetwork Last seenEvents

192.3.165.146USAS36352 HostPapa2026-09-3078

178.16.52.10DEAS202412 Omegatech LTD2026-09-2852

91.92.243.147USAS202412 Omegatech LTD2026-09-1926

8.39.234.20USAS397423 Tier.Net Technologies LLC2026-09-027

172.245.209.151USAS36352 HostPapa2026-09-275

114.228.158.115CNAS140293 CHINATELECOM Jiangsu province Changzhou 5G network2026-09-144

117.63.160.147CNAS140293 CHINATELECOM Jiangsu province Changzhou 5G network2026-09-174

4.217.182.147KRAS8075 Microsoft Corporation2026-09-154

64.89.163.156USAS401626 Netiface America, Inc.2026-09-023

176.65.148.153NLAS51396 Pfcloud UG (haftungsbeschrankt)2026-09-162

174.172.60.127USAS7922 Comcast Cable Communications, LLC2026-09-051

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun020_00040001_78f1f19csame header set49 IPs3.3K b10cun020_00040001_78f1f19csame header set604 IPs2.9K b11cun010_00040000_c4b2c4aa1 header apart647 IPs63.7K b11cun030_00040011_c91eaf541 header apart548 IPs12.1K b10cun010_00040000_c4b2c4aa1 header apart365 IPs2.0K b11cun030_00040003_21fe282e1 header apart17 IPs1.4K b11cun031_00040001_c91eaf54_x74db1 header apart1 IPs402 b10cun030_00040011_c91eaf541 header apart14 IPs111

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.