Akin HTTP request fingerprint

b11cun050_0004001e_6f27235c

Seen 2026-02-16 to 2026-10-23 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS16509 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

2.3K

Events

IPs / network

Top networks

AS16509 Amazon.com, Inc.5 IPs13

AS264617 GRUPO PANAGLOBAL 15 S.A3 IPs2.3K

AS14618 Amazon.com, Inc.1 IP2

Countries

PA 2US 2CH 1IN 1IE 1SE 1FR 1

Ports targeted

443/tcp 217 80/tcp 133 7547/tcp 80 5601/tcp 75 6443/tcp 66 8443/tcp 55 27017/tcp 52 8080/tcp 45 9200/tcp 36 4369/tcp 36 502/tcp 36 2480/tcp 34

What it requests

GET/1.2K

GET/favicon.ico1.0K

GET/security.txt84

GET/.well-known/security.txt84

User agents claimed

Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.363 IPs28

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.153 IPs24

Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.363 IPs23

Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.86 YaBrowser/21.3.0.673 Yowser/2.5 Safari/537.363 IPs23

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.41 YaBrowser/21.2.0.1097 Yowser/2.5 Safari/537.363 IPs22

Source IPCCNetwork Last seenEvents

185.191.236.38CHAS264617 GRUPO PANAGLOBAL 15 S.A2026-10-23963

170.231.236.98PAAS264617 GRUPO PANAGLOBAL 15 S.A2026-10-23743

170.231.237.214PAAS264617 GRUPO PANAGLOBAL 15 S.A2026-10-23605

52.14.197.136USAS16509 Amazon.com, Inc.2026-10-174

13.234.214.153INAS16509 Amazon.com, Inc.2026-10-173

54.77.111.234IEAS16509 Amazon.com, Inc.2026-10-222

32.196.38.110USAS14618 Amazon.com, Inc.2026-10-172

13.62.142.172SEAS16509 Amazon.com, Inc.2026-10-222

15.236.61.7FRAS16509 Amazon.com, Inc.2026-10-172

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun050_0004001e_5f886858same header set489 IPs22.9K b11cun050_0004001e_00ecc3a8same header set82 IPs6.1K b11cun050_0004001e_a13e29a5same header set3 IPs1.6K b11cun050_0004001e_377ad04dsame header set154 IPs348 b11cun050_0004001e_d490606fsame header set65 IPs261 b11cun050_0004001e_b55602bcsame header set10 IPs140 b11cun050_0004001e_a647ba7fsame header set5 IPs91 b11cun050_0004001e_050e4ccesame header set30 IPs64

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.