Akin HTTP request fingerprint

b11cuq090_00050c1f_eda2721f

Seen 2026-02-19 to 2026-09-11 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC6 IPs34

AS12876 Scaleway SAS2 IPs19

AS136258 BrainStorm Network, Inc1 IPs1

Countries

FR 2DE 2US 2GB 1SG 1UA 1

Ports targeted

554/tcp 3 8085/tcp 3 8088/tcp 3 41952/tcp 3 5985/tcp 3 5060/tcp 3 81/tcp 2 2083/tcp 2 2087/tcp 2 3128/tcp 2 5000/tcp 2 5001/tcp 2

What it requests

POST/onvif/device_service54

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.369 IPs54

Source IPCCNetwork Last seenEvents

195.154.48.94FRAS12876 Scaleway SAS2026-09-1010

212.129.34.236FRAS12876 Scaleway SAS2026-09-099

138.68.75.43DEAS14061 DigitalOcean, LLC2026-09-098

178.62.33.244GBAS14061 DigitalOcean, LLC2026-09-107

128.199.255.160SGAS14061 DigitalOcean, LLC2026-09-095

207.154.255.215DEAS14061 DigitalOcean, LLC2026-09-115

143.198.73.73USAS14061 DigitalOcean, LLC2026-09-105

146.190.145.217USAS14061 DigitalOcean, LLC2026-09-104

147.78.3.21UAAS136258 BrainStorm Network, Inc2026-09-051

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq080_0005081f_76504ff61 header apart2 IPs150 b11cuq100_10050c1f_aee5fe3f1 header apart3 IPs8 b11cuq100_10050c1f_fbf50a1e1 header apart3 IPs4 b11cuq090_0005085f_0df56ff02 headers apart50 IPs3.7K b11cuq070_00050817_81cd65142 headers apart306 IPs1.2K b11cuq070_00050817_9c017ed92 headers apart12 IPs231 b11cuq070_00050817_9f8bde3d2 headers apart11 IPs51 b11cuq110_10050c3f_d112b38d2 headers apart8 IPs50

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.