Akin HTTP request fingerprint

b11cun020_00040001_78f1f19c

Seen 2026-02-18 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS25369 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

105

Ports hit

3.3K

Events

IPs / network

Top networks

AS25369 Hydra Communications Ltd16 IPs16

AS200373 3xK Tech GmbH6 IPs6

AS209272 Alviva Holding Limited4 IPs59

AS198953 Proton66 OOO2 IPs114

AS197170 TechTies Inc.2 IPs9

AS399629 BL Networks2 IPs8

AS219502 Storm Industries LLC2 IPs5

AS48090 Techoff Srv Limited1 IPs2.6K

AS47890 Unmanaged Ltd1 IPs387

AS200593 Prospero Ooo1 IPs32

AS215925 Vpsvault.host Ltd1 IPs18

AS49870 Alsycon B.V.1 IPs16

Countries

NL 8GB 8FR 7DE 5RU 4PA 4US 3SG 3SC 2BG 1

Ports targeted

443/tcp 2.7K 4433/tcp 29 450/tcp 21 453/tcp 20 454/tcp 20 5443/tcp 18 460/tcp 18 7547/tcp 16 9192/tcp 15 10443/tcp 15 9191/tcp 15 80/tcp 14

What it requests

GET/login_sid.lua387

GET/155

GET/remote/login82

GET/api/auth/validate-sso18

GEThttp://example.com/16

GET/api/local_raylet_healthz8

GET/settings7

GET/images/icons3/favicon.ico6

GET/app?service=page/Error6

GET/favicon.ico6

GET/app6

GET/dvr/brief.xml5

Source IPCCNetwork Last seenEvents

93.123.109.214BGAS48090 Techoff Srv Limited2026-09-302.6K

2.57.121.203ROAS47890 Unmanaged Ltd2026-09-30387

37.77.150.72RUAS198953 Proton66 OOO2026-09-2484

45.227.253.154PAAS209272 Alviva Holding Limited2026-09-2337

193.24.123.108RUAS200593 Prospero Ooo2026-09-2632

176.120.22.43RUAS198953 Proton66 OOO2026-09-1930

45.198.224.59USAS215925 Vpsvault.host Ltd2026-09-2818

160.119.76.137SCAS49870 Alsycon B.V.2026-09-1316

45.227.253.156PAAS209272 Alviva Holding Limited2026-09-2313

130.12.180.127NLAS202412 Omegatech LTD2026-09-179

172.104.190.164SGAS63949 Akamai Connected Cloud2026-09-119

190.159.36.43COAS14080 Telmex Colombia S.A.2026-09-209

64.62.194.197USAS6939 Hurricane Electric LLC2026-09-078

85.11.167.132NLAS197170 TechTies Inc.2026-09-117

94.154.43.222NLAS0 2026-09-247

45.227.253.150PAAS209272 Alviva Holding Limited2026-09-296

188.186.183.82RUAS41682 JSC ER-Telecom Holding2026-09-145

132.243.160.36FRAS219359 Edge Core FZE2026-09-045

66.179.31.143SGAS399629 BL Networks2026-09-224

69.48.229.164SGAS399629 BL Networks2026-09-224

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b10cun020_00040001_78f1f19csame header set604 IPs2.9K b11cun020_00040001_4e1a3733same header set11 IPs186 b11cun010_00040000_c4b2c4aa1 header apart647 IPs63.7K b11cun030_00040011_c91eaf541 header apart547 IPs12.1K b10cun010_00040000_c4b2c4aa1 header apart365 IPs2.0K b11cun030_00040003_21fe282e1 header apart17 IPs1.4K b11cun031_00040001_c91eaf54_x74db1 header apart1 IPs402 b10cun030_00040011_c91eaf541 header apart14 IPs111

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.