Akin HTTP request fingerprint

b11cun040_00040016_aa48e2c8

Seen 2026-09-30 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS6939 sends an email when it next hits a sensor.

379

Source IPs

Networks

Countries

304

Ports hit

1.3K

Events

IPs / network

Top networks

AS6939 Hurricane Electric LLC171 IPs464

AS398324 Censys, Inc.59 IPs209

AS8075 Microsoft Corporation35 IPs36

AS14618 Amazon.com, Inc.30 IPs33

AS63949 Akamai Connected Cloud18 IPs21

AS398705 Censys, Inc.16 IPs290

AS398722 Censys, Inc.13 IPs42

AS396982 Google LLC10 IPs89

AS21859 Zenlayer Inc8 IPs9

AS202425 IP Volume inc7 IPs16

AS16509 Amazon.com, Inc.3 IPs73

AS51396 Pfcloud UG (haftungsbeschrankt)2 IPs4

Countries

US 366PT 9DE 2NL 1IR 1

Ports targeted

9090/tcp 43 443/tcp 42 5443/tcp 39 80/tcp 28 4434/tcp 26 4369/tcp 23 8443/tcp 22 9200/tcp 21 8080/tcp 21 9000/tcp 16 7443/tcp 16 4343/tcp 16

What it requests

GET/508

GET/favicon.ico123

GET/login23

GET/sellers.json22

GET/robots.txt21

GET/lang/custom/sbin/init20

GET/login?redir=/ng20

GET/api/v2/static/not.found20

GET/lang//custom/sbin/init19

GET/ads.txt19

GET/static/lang//custom/sbin/init19

GET/lang/legacy/filechecksum19

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)88 IPs541

Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)10 IPs89

visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.363 IPs73

Mozilla/5.0 zgrab/0.x46 IPs50

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.3631 IPs34

Source IPCCNetwork Last seenEvents

3.130.168.2USAS16509 Amazon.com, Inc.2026-09-3042

167.94.146.55USAS398705 Censys, Inc.2026-09-3041

167.94.146.53USAS398705 Censys, Inc.2026-09-3027

167.94.146.63USAS398705 Censys, Inc.2026-09-3027

167.94.146.52USAS398705 Censys, Inc.2026-09-3024

74.82.47.5USAS6939 Hurricane Electric LLC2026-09-3024

65.49.20.68USAS6939 Hurricane Electric LLC2026-09-3023

216.218.206.69USAS6939 Hurricane Electric LLC2026-09-3022

167.94.146.48USAS398705 Censys, Inc.2026-09-3021

167.94.146.50USAS398705 Censys, Inc.2026-09-3021

216.218.206.66USAS6939 Hurricane Electric LLC2026-09-3019

3.129.187.38USAS16509 Amazon.com, Inc.2026-09-3019

167.94.146.49USAS398705 Censys, Inc.2026-09-3018

167.94.146.62USAS398705 Censys, Inc.2026-09-3018

167.94.146.57USAS398705 Censys, Inc.2026-09-3018

167.94.146.54USAS398705 Censys, Inc.2026-09-3018

216.180.246.134USAS396982 Google LLC2026-09-3016

216.180.246.62USAS396982 Google LLC2026-09-3016

216.180.246.89USAS396982 Google LLC2026-09-3016

216.180.246.96USAS396982 Google LLC2026-09-3016

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040016_4110f156same header set28 IPs559 b11cun040_00040016_9e0aeda7same header set15 IPs28 b11cun040_00040016_c5bb04c5same header set1 IPs27 b11cun040_00040016_f36dd82esame header set2 IPs10 b11cun030_00040014_03330a181 header apart1 IPs2.9K b11cun030_00040012_13ee3d341 header apart122 IPs149 b11cun030_00040012_a6735d471 header apart1 IPs126 b11cun050_0004001e_5f8868581 header apart12 IPs55

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.