Akin HTTP request fingerprint

b11cun030_00040011_c91eaf54

Seen 2026-02-16 to 2026-10-01 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

594

Source IPs

Networks

Countries

723

Ports hit

11.9K

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC274 IPs6.3K

AS396982 Google LLC77 IPs382

AS37963 Hangzhou Alibaba Advertising Co.,Ltd.38 IPs2.1K

AS200373 3xK Tech GmbH24 IPs24

AS137409 GSL Networks Pty LTD22 IPs28

AS46844 Sharktech20 IPs62

AS4837 CHINA UNICOM China169 Backbone14 IPs14

AS4134 Chinanet11 IPs11

AS219502 Storm Industries LLC6 IPs1.1K

AS211486 Alferov Aleksey Aleksandrovich6 IPs42

AS396356 Latitude.sh6 IPs12

AS36352 HostPapa5 IPs77

Countries

DE 172US 110BE 78CN 72SG 53NL 23GB 12BR 7RU 6CA 6

Ports targeted

443/tcp 616 80/tcp 613 8080/tcp 506 1880/tcp 482 8443/tcp 309 1883/tcp 262 9200/tcp 241 5984/tcp 208 8000/tcp 207 29092/tcp 181 9203/tcp 180 6443/tcp 176

What it requests

GET/1.9K

GET/solr/admin/cores?action=STATUS&wt=json1.0K

GET/solr/admin/info/system1.0K

GET/query?q=SHOW+DIAGNOSTICS1.0K

GET/cgi-bin/authLogin.cgi955

GET/v2/_catalog949

GET/favicon.ico824

GET/settings820

GEThttp://a7x.overflow.biz/hachk.php379

GET/evox/about278

GET/HNAP1244

GET/api/v1/nodes54

User agents claimed

Go-http-client/1.1203 IPs7.1K

Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)41 IPs2.1K

Mozilla/5.021 IPs927

proxy-prefilter/15 IPs379

Mozilla/5.0 (compatible)72 IPs360

Source IPCCNetwork Last seenEvents

94.154.43.203NLAS219502 Storm Industries LLC2026-09-29642

130.12.180.42NLAS202412 Omegatech LTD2026-09-29465

94.154.43.163NLAS219502 Storm Industries LLC2026-09-27336

137.184.68.95USAS14061 DigitalOcean, LLC2026-09-10207

134.209.78.7USAS14061 DigitalOcean, LLC2026-09-13193

159.223.134.160USAS14061 DigitalOcean, LLC2026-09-07186

167.99.149.178USAS14061 DigitalOcean, LLC2026-09-13185

142.93.255.243USAS14061 DigitalOcean, LLC2026-09-16183

167.172.132.204USAS14061 DigitalOcean, LLC2026-09-07182

147.182.162.208USAS14061 DigitalOcean, LLC2026-09-16181

178.128.144.168USAS14061 DigitalOcean, LLC2026-09-30176

104.248.225.113USAS14061 DigitalOcean, LLC2026-09-30173

68.183.126.140USAS14061 DigitalOcean, LLC2026-09-10172

157.230.181.63USAS14061 DigitalOcean, LLC2026-09-30171

147.182.143.140USAS14061 DigitalOcean, LLC2026-09-07167

137.184.218.48USAS14061 DigitalOcean, LLC2026-09-16167

157.245.131.187USAS14061 DigitalOcean, LLC2026-09-10165

68.183.112.48USAS14061 DigitalOcean, LLC2026-09-13162

137.184.138.198USAS14061 DigitalOcean, LLC2026-09-20149

112.124.56.253CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-11147

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b10cun030_00040011_c91eaf54same header set14 IPs113 b11cun030_00040011_213543bfsame header set10 IPs79 b11cun030_00040011_07783b5dsame header set2 IPs5 b11cun040_00040013_608dab681 header apart4.3K IPs243.9K b11cun040_00040015_4c87b06e1 header apart1.5K IPs151.9K b11cun020_00040010_724c10fb1 header apart1.4K IPs70.5K b11cuq040_00040811_2daa70d61 header apart246 IPs6.2K b11cun020_00040001_78f1f19c1 header apart45 IPs4.6K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.