Akin HTTP request fingerprint

b11cun070_0814001b_09650bd9

Seen 2026-02-23 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS202412 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

Top networks

AS202412 Omegatech LTD3 IPs53

AS213954 Global Transit Systems LLC3 IPs3

AS213388 Iic Rail Limited2 IPs24

AS137409 GSL Networks Pty LTD2 IPs18

Countries

US 5NL 3RO 2

Ports targeted

443/tcp 34 4500/tcp 6 500/tcp 6 1723/tcp 6 10443/tcp 5 8443/tcp 5 80/tcp 4 3389/tcp 4 3391/tcp 4 4433/tcp 4 20443/tcp 2 4443/tcp 2

What it requests

GET/+CSCOE+/logon.html98

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.20310 IPs98

Source IPCCNetwork Last seenEvents

130.12.180.19NLAS202412 Omegatech LTD2026-09-1332

151.240.104.196USAS137409 GSL Networks Pty LTD2026-09-1617

45.142.193.239ROAS213388 Iic Rail Limited2026-09-0816

130.12.180.35NLAS202412 Omegatech LTD2026-09-1516

45.142.193.24ROAS213388 Iic Rail Limited2026-09-078

130.12.180.138NLAS202412 Omegatech LTD2026-09-305

45.147.11.66USAS213954 Global Transit Systems LLC2026-09-211

104.245.242.201USAS213954 Global Transit Systems LLC2026-09-211

45.147.11.70USAS213954 Global Transit Systems LLC2026-09-211

151.240.92.42USAS137409 GSL Networks Pty LTD2026-09-121

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun070_0014001f_ee0f0ad42 headers apart14 IPs177 b11cun070_0014001f_c92214f92 headers apart5 IPs155 b11cun070_0014001f_431a2e962 headers apart34 IPs66 b11cun070_0014001f_852404262 headers apart12 IPs53 b11cun070_0014001f_0e0f40c92 headers apart32 IPs38 b11cun070_0814001d_31ebb68a2 headers apart16 IPs33 b11cun050_0004001b_f6ae26312 headers apart17 IPs18 b11cun050_0004001b_2d33220a2 headers apart5 IPs5

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.