Akin HTTP request fingerprint

b11cun060_0004001f_e609a46c

Seen 2026-02-27 to 2026-09-26 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS37963 sends an email when it next hits a sensor.

311

Source IPs

Networks

Countries

387

Ports hit

852

Events

156

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS37963 Hangzhou Alibaba Advertising Co.,Ltd.310 IPs850

AS30860 Virtual Systems LLC1 IPs2

Countries

CN 310UA 1

Ports targeted

1024/tcp 6 56379/tcp 5 52873/tcp 5 50001/tcp 5 27017/tcp 5 19000/tcp 5 15443/tcp 5 12225/tcp 5 8063/tcp 5 5050/tcp 5 1812/tcp 5 53182/tcp 4

What it requests

GET/481

GET/favicon.ico369

GET/.DS_Store2

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36310 IPs850

Mozilla/5.01 IPs2

Source IPCCNetwork Last seenEvents

121.41.166.50CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-269

39.100.86.191CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-268

112.124.56.43CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-268

47.97.111.180CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-268

121.41.164.122CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-257

47.95.198.233CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-267

121.41.167.124CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-267

47.95.204.180CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-266

39.100.83.111CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-256

121.41.166.218CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-266

112.124.54.115CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-266

121.41.167.40CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-126

47.95.199.236CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-266

47.96.91.95CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-176

47.94.210.24CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-176

121.41.167.197CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-265

47.95.205.12CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-265

121.43.119.139CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-265

47.95.209.142CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-265

121.43.117.235CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-09-265

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun060_0004001f_d170ef01same header set16 IPs37.5K b11cun060_0004001f_eefe5210same header set19 IPs5.8K b11cun060_0004001f_7d5e642bsame header set448 IPs2.7K b11cun060_0004001f_b9768d0esame header set2 IPs2.3K b11cun060_0004001f_9b6188bfsame header set29 IPs1.3K b11cun060_0004001f_561f323asame header set159 IPs605 b11cun060_0004001f_9dee14a7same header set3 IPs144 b11cun060_0004001f_efc53d1esame header set5 IPs55

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.