Akin HTTP request fingerprint

b11cun080_00340037_c3a11425

Seen 2026-03-07 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS202425 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

138

Ports hit

203

Events

IPs / network

Top networks

AS202425 IP Volume inc6 IPs203

Countries

NL 6

Ports targeted

27017/tcp 4 8472/tcp 4 9107/tcp 4 6781/tcp 3 16464/tcp 3 8080/tcp 3 8181/tcp 3 9503/tcp 3 3333/tcp 3 6385/tcp 3 51820/tcp 3 2375/tcp 3

What it requests

GET/203

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.366 IPs203

Source IPCCNetwork Last seenEvents

80.82.77.202NLAS202425 IP Volume inc2026-09-3052

89.248.172.33NLAS202425 IP Volume inc2026-09-3045

89.248.171.24NLAS202425 IP Volume inc2026-09-3041

93.174.93.12NLAS202425 IP Volume inc2026-09-3041

89.248.171.23NLAS202425 IP Volume inc2026-09-0519

94.102.63.23NLAS202425 IP Volume inc2026-09-055

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cdn100_0034003f_d1da082f1 header apart408 IPs1.1K b11cun090_0034003f_2b3ca27d1 header apart5 IPs9 b11cun070_00240037_f0fb29381 header apart1 IPs2 b11cun090_0034003f_f5e9688a1 header apart1 IPs2 b11cun070_00140037_0b6ffdfa1 header apart1 IPs2 b11cun090_0034003f_eaca82e61 header apart2 IPs2 b11cun070_00340017_f92006d21 header apart1 IPs2 b11cun090_00340437_8f0f46bc1 header apart2 IPs2

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.