Akin HTTP request fingerprint

b11cun040_00040015_00b09b79

Seen 2026-05-10 to 2026-10-01 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS401661 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

3.1K

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS401661 EMBNEX, LLC1 IPs2.8K

AS215925 Vpsvault.host Ltd1 IPs206

AS203273 NetCrafters OU1 IPs8

AS51396 Pfcloud UG (haftungsbeschrankt)1 IPs6

Countries

US 2BR 1CY 1NL 1

Ports targeted

80/tcp 882 8080/tcp 845 8081/tcp 465 9090/tcp 425 8443/tcp 212 8085/tcp 31 8089/tcp 25 1024/tcp 23 81/tcp 22 88/tcp 22 8010/tcp 22 8888/tcp 22

What it requests

GET/3.1K

GET/csrf-token4

User agents claimed

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.03 IPs3.1K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.361 IPs8

Source IPCCNetwork Last seenEvents

16.5.0.236USAS401661 EMBNEX, LLC2026-09-302.8K

45.198.224.125USAS215925 Vpsvault.host Ltd2026-10-01206

171.22.114.108CYAS203273 NetCrafters OU2026-09-108

204.76.203.50NLAS51396 Pfcloud UG (haftungsbeschrankt)2026-09-096

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040015_4c87b06esame header set1.5K IPs151.9K b10cun040_00040015_4c87b06esame header set16 IPs1.4K b11cun040_00040015_a4cdfabfsame header set31 IPs585 b11cun040_00040015_5cd6f744same header set2 IPs340 b11cun040_00040015_ba182931same header set6 IPs152 b11cun040_00040015_d76a48e1same header set3 IPs104 b11cun040_00040015_b03a935bsame header set3 IPs61 b11cun040_00040015_f0265a0esame header set34 IPs34

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.