Akin HTTP request fingerprint

b11cun070_0004003f_a62fe657

Seen 2026-05-05 to 2026-09-29 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS132203 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS132203 Tencent Building, Kejizhongyi Avenue26 IPs47

AS6730 Sunrise GmbH1 IPs1

Countries

US 19TH 7CH 1

Ports targeted

80/tcp 44 443/tcp 4

What it requests

GET/47

GET/photo1

User agents claimed

Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.126 IPs47

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.361 IPs1

Source IPCCNetwork Last seenEvents

43.173.248.8THAS132203 Tencent Building, Kejizhongyi Avenue2026-09-295

43.135.140.163USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-245

43.173.123.22USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-233

43.153.31.117USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-283

43.173.120.130USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-213

43.173.125.4USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-292

43.153.18.149USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-202

49.51.74.96USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-212

43.173.249.61THAS132203 Tencent Building, Kejizhongyi Avenue2026-09-152

43.173.127.111USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-252

43.173.251.70THAS132203 Tencent Building, Kejizhongyi Avenue2026-09-282

43.173.252.50THAS132203 Tencent Building, Kejizhongyi Avenue2026-09-212

43.153.35.251USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-031

49.51.50.175USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-081

170.106.177.90USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-161

31.165.37.81CHAS6730 Sunrise GmbH2026-09-191

43.173.253.79THAS132203 Tencent Building, Kejizhongyi Avenue2026-09-061

43.173.126.206USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-031

49.51.188.219USAS132203 Tencent Building, Kejizhongyi Avenue2026-08-311

43.173.126.74USAS132203 Tencent Building, Kejizhongyi Avenue2026-09-161

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun070_0004003f_be36b091same header set1 IPs29 b11cun070_0004003f_f09b18d3same header set1 IPs28 b11cun070_0004003f_8a4d1a98same header set11 IPs23 b11cun070_0004003f_64c36ce5same header set1 IPs2 b11cun070_0004003f_47eb7f5asame header set1 IPs2 b11cun070_0004003f_698a23cesame header set1 IPs2 b11cun070_0004003f_176ad6ebsame header set1 IPs1 b11cun060_0004003d_f55b17ef1 header apart4 IPs126.2K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.