Akin HTTP request fingerprint

b11cun030_00040012_f6d8d797

Seen 2026-02-17 to 2026-10-01 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

2.6K

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC34 IPs1.4K

AS63949 Akamai Connected Cloud21 IPs880

AS396982 Google LLC4 IPs131

AS36903 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM1 IPs49

AS218785 Tc Datacenter Limited1 IPs45

AS48090 Techoff Srv Limited1 IPs38

AS8075 Microsoft Corporation1 IPs14

AS401626 Netiface America, Inc.1 IPs7

AS32097 WholeSale Internet, Inc.1 IPs7

AS214036 Ultahost, Inc.1 IPs7

Countries

US 52CA 4BE 3GB 2DE 2MA 1LT 1BG 1

Ports targeted

443/tcp 769 80/tcp 467 4443/tcp 316 8443/tcp 315 4433/tcp 237 4444/tcp 237 8080/tcp 237 10443/tcp 7 5985/tcp 4 5986/tcp 4

What it requests

GET/.env41

GET/.git/config41

GET/40

GET/wsman36

GET/php/ztp_gate.php/.js.map35

GET/login.jsp29

GET/Login/Login29

GET/api/v2/cmdb/system/admin29

GET/client29

GET/admin29

GET/jira/secure/Dashboard.jspa29

GET/logon/LogonPoint/custom.html29

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.3655 IPs2.3K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.364 IPs162

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.366 IPs98

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.361 IPs38

Source IPCCNetwork Last seenEvents

143.110.134.139USAS14061 DigitalOcean, LLC2026-09-1680

68.183.29.251USAS14061 DigitalOcean, LLC2026-09-1279

97.107.137.245USAS63949 Akamai Connected Cloud2026-09-1679

173.255.206.220USAS63949 Akamai Connected Cloud2026-09-1679

138.68.10.54USAS14061 DigitalOcean, LLC2026-09-1579

138.68.237.131USAS14061 DigitalOcean, LLC2026-09-1279

192.241.136.162USAS14061 DigitalOcean, LLC2026-09-1279

45.79.143.112USAS63949 Akamai Connected Cloud2026-09-1579

143.244.153.58USAS14061 DigitalOcean, LLC2026-09-1579

138.197.173.137CAAS14061 DigitalOcean, LLC2026-09-1279

104.200.20.244USAS63949 Akamai Connected Cloud2026-09-1279

159.223.185.62USAS14061 DigitalOcean, LLC2026-09-1579

165.227.23.54USAS14061 DigitalOcean, LLC2026-09-1579

172.104.240.74DEAS63949 Akamai Connected Cloud2026-09-1579

142.93.10.66USAS14061 DigitalOcean, LLC2026-09-1679

138.197.221.54USAS14061 DigitalOcean, LLC2026-09-1279

64.225.35.230USAS14061 DigitalOcean, LLC2026-09-2678

45.56.72.142USAS63949 Akamai Connected Cloud2026-09-0878

185.3.95.31GBAS63949 Akamai Connected Cloud2026-09-2778

143.244.148.132USAS14061 DigitalOcean, LLC2026-09-1078

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun030_00040012_13ee3d34same header set5.1K IPs226.7K b11cun030_00040012_a6735d47same header set2 IPs504 b11cun040_00040016_aa48e2c81 header apart6.2K IPs530.0K b11cun040_00040013_608dab681 header apart4.3K IPs243.9K b11cun040_00040016_4110f1561 header apart288 IPs170.8K b11cun020_00040010_724c10fb1 header apart1.4K IPs70.5K b11cun040_00040016_9e0aeda71 header apart50 IPs8.4K b11cun040_00040016_c1d300831 header apart49 IPs6.4K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.