Akin HTTP request fingerprint

b11cun050_00050013_2619b3ac

Seen 2026-02-16 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS48090 Techoff Srv Limited1 IPs51

Unattributed1 IPs8

AS154107 DigitalLink Global Network Limited1 IPs1

AS198020 Verda Cloud Oy1 IPs1

Countries

BG 1NL 1US 1FI 1

Ports targeted

443/tcp 53 80/tcp 2 2375/tcp 2 8080/tcp 2 8443/tcp 2

What it requests

GET/nifi-api/flow/about8

GET/7

GET/wp-admin/profile.php4

GET/jnoj/web/polygon/problem/viewfile?id=1&name=../../../../../../../etc/passwd3

GET/wp-json/mapsvg/v1/maps/2?id=1%27%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(6)))b)--+2

GET/version2

GET/testing-put.txt2

GET/qvisdvr/2

GET/wp-json/wp/v2/add-listing?id=12

GET/wp-content/plugins/wp-fastest-cache/2

GET/prweb/2

GET/elfinder/php/connector.minimal.php?cmd=file&target=l1_<@base64>/var/www/html/elfinder/files//..//..//..//..//..//../etc/passwd<@/base64>&download=12

User agents claimed

Go-http-client/1.11 IPs8

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.151 IPs2

Mozilla/5.01 IPs1

Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/11.01 IPs1

Python-urllib/3.141 IPs1

Source IPCCNetwork Last seenEvents

93.123.109.214BGAS48090 Techoff Srv Limited2026-09-3051

94.154.43.7NLAS0 2026-09-178

86.38.182.156FIAS198020 Verda Cloud Oy2026-09-151

69.33.213.156USAS154107 DigitalLink Global Network Limited2026-09-261

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040013_608dab681 header apart4.3K IPs243.3K b11cuq060_00050813_95cc9d021 header apart55 IPs3.1K b11cun040_00040013_ab9bb0751 header apart58 IPs567 b11cun061_00050013_f5830403_x06591 header apart52 IPs162 b11cun040_00050011_bf8a4cbb1 header apart6 IPs152 b11cuq060_00050813_8587a3e31 header apart4 IPs107 b11cun040_00040013_7df024fe1 header apart2 IPs45 b11cuk061_00050013_95cc9d02_xed801 header apart1 IPs23

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.