Akin HTTP request fingerprint

b11cuq060_00040817_1d464540

Seen 2026-04-02 to 2026-09-30 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS48090 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS48090 Techoff Srv Limited1 IPs8

AS4134 Chinanet1 IPs1

Countries

BG 1CN 1

Ports targeted

443/tcp 8 8161/tcp 1

What it requests

POST/login.htm3

POST/cgi-bin/system_mgr.cgi3

POST/2

PUT/fileserver/afrog-poc.txt1

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.151 IPs1

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.01 IPs1

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.151 IPs1

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.151 IPs1

Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.361 IPs1

Source IPCCNetwork Last seenEvents

93.123.109.214BGAS48090 Techoff Srv Limited2026-09-308

106.58.237.189CNAS4134 Chinanet2026-09-241

Fingerprint family: 11 shapes, 1.3K IPs, 116.9K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 5 headers, no body: connection, accept-encoding, accept, user-agent, host

asks for/.azure/credentials · /.netrc · /my.ini · /personal.auto.tfvars (GET / POST)

asMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like G and 155 more

ports5000 · 5005 · 3000 · 1723

fromNL · DE · CY · HK · Limited Network LTD · Feo Prest SRL · NetCrafters OU

b11cun050_00040017_6b90553bMozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 · /1.3K IPs9.3K b11cun051_00040016_6289c865_x2269+/- connection, range · Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 · /credentials3 IPs93.2K b11cun061_00040017_a9482ae2_x74db+/- proxy-authorization · python-requests/2.34.2 · http://ip-api.com/json/?fields=status,country,countryCode,qu3 IPs59 b11cun060_00440017_1d464540+/- authorization · ghost-pay-hunter · /admin/3 IPs6 b11cuq082_00040817_03a2bf31_xd368ff63+/- content-length, x-csrf-token, x-requested-with · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /panel/api/inbounds/list2 IPs7.8K b11cun072_00040017_4c344a22_xd368ff63+/- x-csrf-token, x-requested-with · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /xui/API/inbounds/2 IPs5.8K b11cdn071_00040017_9f8bde3d_xd99b+/- d99b · Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like G · /.env2 IPs412 b11cun061_00040017_c5b51fcd_xff63+/- x-requested-with · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /csrf-token2 IPs221 b11cun040_00040016_03bbcb12+/- connection · CryptoHunter-Vite-2026/1.0 · /src/main.ts2 IPs50 b11cuq060_00040817_1d464540 this one+/- content-length · Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0 · /login.htm2 IPs9 b11cun050_00040017_69b07330Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /cgi-bin/login.cgi2 IPs5

All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq060_00040817_a9482ae2same header set69 IPs77 b11cuq060_00040817_8e5e346csame header set4 IPs19 b11cuq060_00040817_6f9878d6same header set1 IPs3 b11cuq060_00040817_229ec904same header set1 IPs1 b11cuq060_00040817_d95592f1same header set1 IPs1 b11cun050_00040017_976354f01 header apart1.3K IPs18.8K b11cun050_00040017_6b90553b1 header apart1.3K IPs9.3K b11cun050_00040017_e873236c1 header apart680 IPs6.1K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.