Akin HTTP request fingerprint

b11cun050_00040035_dd905059

Seen 2026-02-16 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

280

Source IPs

137

Networks

Countries

Ports hit

1.9K

Events

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.35 IPs127

AS51167 Contabo GmbH13 IPs82

AS31898 Oracle Corporation10 IPs89

AS14061 DigitalOcean, LLC10 IPs46

AS37963 Hangzhou Alibaba Advertising Co.,Ltd.8 IPs30

AS45090 Shenzhen Tencent Computer Systems Company Limited8 IPs26

AS36352 HostPapa7 IPs24

AS8075 Microsoft Corporation6 IPs29

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED5 IPs62

AS137718 Beijing Volcano Engine Technology Co., Ltd.5 IPs19

AS16276 OVH SAS4 IPs26

AS150436 Byteplus Pte. Ltd.4 IPs22

Countries

US 59CN 31SG 25FR 18VN 14IN 11DE 11ID 9NL 9HK 9

Ports targeted

443/tcp 895 80/tcp 731 2375/tcp 234

What it requests

GET/containers/json558

GET/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello326

GET/index.php?lang=../../../../../../../../tmp/index1326

GET/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5("hi"));?>+/tmp/index1.php325

GET/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello325

User agents claimed

libredtail-http280 IPs1.9K

Source IPCCNetwork Last seenEvents

87.192.253.110UZAS202660 Uzbektelekom Joint Stock Company2026-09-3086

31.132.90.3KZAS197556 Kar-Tel LLC2026-09-2375

103.46.186.148IDAS150462 PT Air Lintas Komunikasi2026-09-2753

103.46.186.85IDAS150462 PT Air Lintas Komunikasi2026-09-2749

223.123.65.54PKAS59257 CMPak Limited2026-09-2749

95.85.245.227EEAS209693 Oc Networks Limited2026-09-2830

165.99.207.153PKAS45773 PERN AS Content Servie Provider, Islamabad, Pakistan2026-09-2828

95.173.161.147TRAS51559 Netinternet Bilisim Teknolojileri AS2026-09-1928

107.150.97.10USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2525

45.43.37.254TWAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-3025

160.250.132.238VNAS150895 EZ TECHNOLOGY COMPANY LIMITED2026-09-2823

167.71.233.141INAS14061 DigitalOcean, LLC2026-09-2921

103.63.101.24IDAS150273 PT Berkah Maju Interasional2026-09-2821

160.187.247.119VNAS150862 VPSTTT COMPUTER COMPANY LIMITED2026-09-2021

124.158.13.4VNAS38733 CMC Telecom Infrastructure Company2026-09-2021

138.2.102.66SGAS31898 Oracle Corporation2026-09-0921

37.120.213.13CHAS9009 M247 Europe SRL2026-09-2520

95.130.227.78UZAS35682 Best Internet Solution Xk2026-09-2420

102.244.97.185CMAS36912 Orange Cameroun SA2026-09-2718

43.110.38.5USAS45102 Alibaba (US) Technology Co., Ltd.2026-09-1517

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040015_4c87b06e1 header apart1.5K IPs160.3K b11cun060_0004003d_f55b17ef1 header apart4 IPs125.9K b11cun040_00040015_00b09b791 header apart4 IPs2.9K b10cun040_00040015_4c87b06e1 header apart16 IPs1.4K b11cun060_0004003d_8084a0271 header apart4 IPs587 b11cun040_00040015_a4cdfabf1 header apart35 IPs580 b11cun040_00040015_5cd6f7441 header apart1 IPs336 b11cun040_00040015_ba1829311 header apart6 IPs152

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.