Akin HTTP request fingerprint

b11cuq060_00450812_0421ce22

Seen 2026-04-01 to 2026-10-17 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS53667 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS53667 FranTech Solutions1 IP6

AS202412 Omegatech LTD1 IP3

Countries

US 1NL 1

Ports targeted

21/tcp 6 80/tcp 2 8080/tcp 1

What it requests

POST/apply.cgi3

POST/checkValid2

POST/boafrm/formSysCmd2

POST/service/v1/createUser2

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.361 IP3

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.361 IP2

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2 rv:2.0; mai-IN) AppleWebKit/533.27.1 (KHTML, like Gecko) Version/5.0 Safari/533.27.11 IP2

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.01 IP2

Source IPCCNetwork Last seenEvents

209.141.59.162USAS53667 FranTech Solutions2026-10-176

130.12.180.32NLAS202412 Omegatech LTD2026-10-153

Fingerprint family: 9 shapes, 149 IPs, 2.5K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 5 headers, Content-Length body: accept-encoding, user-agent, content-length, content-type, host

asks for/ · /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php · /icecoder/lib/terminal-xhr.php · /lib/terminal-xhr.php (POST / GET)

asMozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) · Go-http-client/1.1 · Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot) and 298 more

ports443 · 21 · 8080 · 8545

fromUS · DE · NL · JP · Google LLC · FranTech Solutions · Censys, Inc.

b11cuq050_00050812_107c8b82Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) · /149 IPs1.5K b11cuq082_00050816_8184102b_xd0f1e7f3+/- accept, next-action, x-middleware-subrequest · Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) · /61 IPs676 b11cuq104_00050816_8fb55415_x038e0ee6d0f1e7f3+/- accept, 0ee6, next-action, next-router-state-tree, x-middleware-subrequest · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1 · /api38 IPs234 b11cuq061_00050812_0421ce22_x48ab+/- spring.cloud.function.routing-expression · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0 · /functionRouter18 IPs46 b11cuq060_00850812_0421ce22+/- soapaction · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /6 IPs14 b11cuq061_00050812_0421ce22_xe1a2+/- e1a2 · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; · /flowise/api/v1/node-custom-function5 IPs10 b11cun040_00050012_cfad16f7+/- content-length · Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.14 · /2 IPs20 b11cuq060_00450812_0421ce22 this one+/- authorization · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /apply.cgi2 IPs9 b11cuq051_00040812_48a35abe_x3fe2+/- content-type, 3fe2 · Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605.1.15 (KHTML, lik · /api/v1/fabric_device_auth/fortigate/init2 IPs2

All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq050_00050812_107c8b821 header apart149 IPs1.5K b11cuq070_00450813_aee6d12e1 header apart2 IPs191 b11cuq060_00050813_95cc9d022 headers apart40 IPs13.1K b11cuq040_00440810_a31e7c352 headers apart395 IPs554 b11cuq060_00050816_84d4cebf2 headers apart305 IPs462 b11cun060_00450013_95cc9d022 headers apart4 IPs164 b11cuq061_00050812_0421ce22_xe7f32 headers apart6 IPs145 b11cuq040_00040812_cfad16f72 headers apart23 IPs95

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.