Akin HTTP request fingerprint

b11cun050_00040413_2619b3ac

Seen 2026-02-19 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

289

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC6 IPs168

AS12876 Scaleway SAS2 IPs95

AS48090 Techoff Srv Limited1 IPs21

AS136258 BrainStorm Network, Inc1 IPs5

Countries

FR 2DE 2US 2GB 1SG 1BG 1UA 1

Ports targeted

443/tcp 21 8088/tcp 15 554/tcp 15 8085/tcp 15 5985/tcp 15 5060/tcp 15 41952/tcp 14 81/tcp 10 2083/tcp 10 2087/tcp 10 3128/tcp 10 5000/tcp 10

What it requests

GET/162

GET/PSIA/index54

GET/HNAP152

GET/images/..%2finfo.html6

GET/plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent="%20UNION%20SELECT%20NULL,NULL,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION(),md5(999999999)),NULL,NULL,NULL,NULL,NULL--%20aa3

GET/wp-admin/options.php2

GET/interface-data/books-init2

GET/guest/s/default/login?page_error=..%2F..%2Fweb.xml2

GET/index.php?m=default&c=user&a=register&u=02

GET/3K2WNQucJmtwRa7OO8pS4GZqYXw.txt1

GET/3K2WNRAQ7BO3hbf5vWo6xtaFxni.txt1

GET/3JxN8gyf2S5fWHcJX7eB2ptTLi2.txt1

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.369 IPs268

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.361 IPs1

Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.121 IPs1

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.01 IPs1

Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.361 IPs1

Source IPCCNetwork Last seenEvents

195.154.48.94FRAS12876 Scaleway SAS2026-09-1050

212.129.34.236FRAS12876 Scaleway SAS2026-09-0945

138.68.75.43DEAS14061 DigitalOcean, LLC2026-09-0939

178.62.33.244GBAS14061 DigitalOcean, LLC2026-09-1034

128.199.255.160SGAS14061 DigitalOcean, LLC2026-09-0925

207.154.255.215DEAS14061 DigitalOcean, LLC2026-09-1125

143.198.73.73USAS14061 DigitalOcean, LLC2026-09-1025

93.123.109.214BGAS48090 Techoff Srv Limited2026-09-3021

146.190.145.217USAS14061 DigitalOcean, LLC2026-09-1020

147.78.3.21UAAS136258 BrainStorm Network, Inc2026-09-055

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b10cun050_00040413_a4fc9b3esame header set41 IPs5.0K b11cun050_00040413_ca60424esame header set1 IPs4 b11cun040_00040013_608dab681 header apart4.3K IPs243.3K b11cun040_00040013_ab9bb0751 header apart58 IPs567 b11cun060_00060413_0af44bea1 header apart40 IPs210 b11cun040_00040411_2daa70d61 header apart7 IPs149 b11cun040_00040013_7df024fe1 header apart2 IPs45 b11cun040_00040013_2178e07e1 header apart12 IPs13

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.