Akin HTTP request fingerprint

b11cun160_003477fe_6d1ef716

Seen 2026-03-17 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS212512 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

1.6K

Ports hit

3.5K

Events

IPs / network

Top networks

AS212512 Detai Prosperous Technologies Limited6 IPs3.5K

Countries

DE 6US 4

Ports targeted

64295/tcp 6 50090/tcp 6 15044/tcp 6 8704/tcp 6 8087/tcp 6 7020/tcp 6 4045/tcp 6 1085/tcp 6 65389/tcp 5 60443/tcp 5 57294/tcp 5 50389/tcp 5

What it requests

GET/favicon.ico3.5K

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.366 IPs69

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.06 IPs64

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.366 IPs58

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.366 IPs57

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.366 IPs57

Source IPCCNetwork Last seenEvents

45.131.155.111DEAS212512 Detai Prosperous Technologies Limited2026-09-10744

45.131.155.110DEAS212512 Detai Prosperous Technologies Limited2026-09-10723

45.131.155.100USAS212512 Detai Prosperous Technologies Limited2026-09-30602

45.131.155.101USAS212512 Detai Prosperous Technologies Limited2026-09-30531

45.131.155.103USAS212512 Detai Prosperous Technologies Limited2026-09-30499

45.131.155.102USAS212512 Detai Prosperous Technologies Limited2026-09-30421

Fingerprint family: 2 shapes, 6 IPs, 4.3K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 16 headers, no body: accept-encoding, accept, accept-language, user-agent, upgrade-insecure-requests, sec-fetch-mode, sec-fetch-site, sec-fetch-dest, sec-fetch-user, referer, sec-ch-ua-platform, sec-ch-ua, sec-ch-ua-mobile, host, cache-control, pragma

asks for/favicon.ico (GET)

asMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/1 · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 and 155 more

ports4002 · 3370 · 4003 · 8005

fromDE · US · Detai Prosperous Technologies Limited

b11cun160_003477fe_6d1ef716 this oneMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 · /favicon.ico6 IPs3.5K b11cun160_003477fe_56d8b205Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /favicon.ico6 IPs802

All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cun160_003477fe_56d8b205same header set6 IPs802 b11cun150_003473fe_14dc94d81 header apart51 IPs24.9K b11cun150_003473fe_5e0a1b421 header apart1 IPs665 b11cun160_003473ff_fa401f0f2 headers apart3 IPs15

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.