Akin HTTP request fingerprint

b11cun120_003403f7_3371db99

Seen 2026-04-10 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS202425 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

169

Ports hit

317

Events

IPs / network

Top networks

AS202425 IP Volume inc6 IPs317

Countries

NL 6

Ports targeted

2525/tcp 5 1293/tcp 4 9955/tcp 4 9800/tcp 4 58846/tcp 4 222/tcp 4 2715/tcp 4 28888/tcp 4 5000/tcp 4 5353/tcp 4 18091/tcp 4 8888/tcp 4

What it requests

GET/317

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.366 IPs317

Source IPCCNetwork Last seenEvents

93.174.93.12NLAS202425 IP Volume inc2026-09-3086

89.248.171.24NLAS202425 IP Volume inc2026-09-3080

89.248.172.33NLAS202425 IP Volume inc2026-09-3065

80.82.77.202NLAS202425 IP Volume inc2026-09-3057

89.248.171.23NLAS202425 IP Volume inc2026-09-0621

94.102.63.23NLAS202425 IP Volume inc2026-09-058

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun130_003403ff_e63378d11 header apart9 IPs21

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.