Akin HTTP request fingerprint

b11cun050_00440013_2619b3ac

Seen 2026-03-05 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

Top networks

AS396982 Google LLC8 IPs12

AS48090 Techoff Srv Limited2 IPs46

AS45090 Shenzhen Tencent Computer Systems Company Limited1 IPs3

AS197170 TechTies Inc.1 IPs1

AS132203 Tencent Building, Kejizhongyi Avenue1 IPs1

Countries

US 8BG 2CN 1NL 1SG 1

Ports targeted

443/tcp 30 8081/tcp 16 20128/tcp 5 4000/tcp 4 1984/tcp 3 80/tcp 2 8000/tcp 2 3000/tcp 1

What it requests

GET/v1/models27

GET/b_download/index.html4

GET/api/config3

GET/cgi-bin/cgiServer.exx?download=/etc/passwd3

GET/admin/default/2

GET/model/info2

GET/dview8/api/usersByLevel2

GET/userRpm/MenuRpm.htm2

GET/_api/web/siteusers2

GET/Status_Router.asp2

GET/delsnap.pl?name=|id2

GET/cslu/v1/scheduler/jobs2

User agents claimed

Python-urllib/3.122 IPs15

insomnia/2023.5.88 IPs12

Python-urllib/3.111 IPs3

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.361 IPs2

Go-http-client/1.11 IPs1

Source IPCCNetwork Last seenEvents

93.123.109.214BGAS48090 Techoff Srv Limited2026-09-3029

195.178.110.50BGAS48090 Techoff Srv Limited2026-09-2817

136.66.212.132USAS396982 Google LLC2026-09-283

82.156.249.126CNAS45090 Shenzhen Tencent Computer Systems Company Limited2026-09-263

34.75.89.54USAS396982 Google LLC2026-09-293

35.233.248.75USAS396982 Google LLC2026-09-271

34.24.42.105USAS396982 Google LLC2026-09-271

34.72.184.181USAS396982 Google LLC2026-09-261

34.48.89.18USAS396982 Google LLC2026-09-281

170.106.117.80USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-241

146.148.66.182USAS396982 Google LLC2026-09-261

34.124.199.240SGAS396982 Google LLC2026-09-291

91.92.47.116NLAS197170 TechTies Inc.2026-09-061

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun040_00040013_608dab681 header apart4.3K IPs243.3K b11cun040_00040013_ab9bb0751 header apart58 IPs567 b11cun040_00040013_7df024fe1 header apart2 IPs45 b11cun060_00440017_db4702471 header apart3 IPs42 b11cun040_00040013_2178e07e1 header apart12 IPs13 b11cun040_00040013_89f46b261 header apart4 IPs12 b11cun060_00440017_1d4645401 header apart3 IPs6 b11cun040_00440011_2daa70d61 header apart5 IPs6

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.