Akin HTTP request fingerprint

b11cuq104_00050816_8fb55415_x038e0ee6d0f1e7f3

Seen 2026-10-17 to 2026-10-20 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

234

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS396982 Google LLC38 IPs234

Countries

US 9BR 7CA 6DE 5NL 3BE 3JP 3SG 1TW 1

Ports targeted

443/tcp 234

What it requests

POST/78

POST/app78

POST/api78

User agents claimed

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)11 IPs12

Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)10 IPs11

Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)9 IPs11

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)8 IPs10

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot8 IPs10

Source IPCCNetwork Last seenEvents

34.89.162.226DEAS396982 Google LLC2026-10-1912

34.22.198.120BEAS396982 Google LLC2026-10-176

34.81.36.188TWAS396982 Google LLC2026-10-206

35.231.226.99USAS396982 Google LLC2026-10-176

34.19.212.97CAAS396982 Google LLC2026-10-176

35.198.90.114DEAS396982 Google LLC2026-10-176

34.151.205.95BRAS396982 Google LLC2026-10-176

35.233.112.19BEAS396982 Google LLC2026-10-186

34.91.36.200NLAS396982 Google LLC2026-10-186

136.110.109.15JPAS396982 Google LLC2026-10-176

35.246.152.18DEAS396982 Google LLC2026-10-186

35.234.164.109NLAS396982 Google LLC2026-10-176

34.73.172.220USAS396982 Google LLC2026-10-196

34.47.26.173CAAS396982 Google LLC2026-10-176

35.198.156.65DEAS396982 Google LLC2026-10-176

34.39.238.231BRAS396982 Google LLC2026-10-176

34.187.169.24USAS396982 Google LLC2026-10-206

34.39.163.213BRAS396982 Google LLC2026-10-176

34.83.66.181USAS396982 Google LLC2026-10-206

34.95.194.218BRAS396982 Google LLC2026-10-176

Fingerprint family: 9 shapes, 148 IPs, 2.5K events in 30 days

Every shape here is within one request header of the family's largest shape and comes from the same source addresses. One tool, several request shapes; a hashed fingerprint shows these as unrelated.

HTTP/1.1, 5 headers, Content-Length body: accept-encoding, user-agent, content-length, content-type, host

asks for/ · /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php · /lib/terminal-xhr.php · /icecoder/lib/terminal-xhr.php (POST / GET)

asMozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) · Go-http-client/1.1 · Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) and 297 more

ports443 · 21 · 8080 · 8545

fromUS · DE · NL · JP · Google LLC · FranTech Solutions · Censys, Inc.

b11cuq050_00050812_107c8b82Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) · /148 IPs1.5K b11cuq082_00050816_8184102b_xd0f1e7f3+/- accept, next-action, x-middleware-subrequest · Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) · /60 IPs664 b11cuq104_00050816_8fb55415_x038e0ee6d0f1e7f3 this one+/- accept, 0ee6, next-action, next-router-state-tree, x-middleware-subrequest · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1 · /api37 IPs228 b11cuq061_00050812_0421ce22_x48ab+/- spring.cloud.function.routing-expression · Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0 · /functionRouter18 IPs46 b11cuq060_00850812_0421ce22+/- soapaction · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /6 IPs14 b11cuq061_00050812_0421ce22_xe1a2+/- e1a2 · Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/d · /flowise/api/v1/node-custom-function4 IPs8 b11cun040_00050012_cfad16f7+/- content-length · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /2 IPs20 b11cuq060_00450812_0421ce22+/- authorization · Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) · /apply.cgi2 IPs9 b11cuq051_00040812_48a35abe_x3fe2+/- content-type, 3fe2 · Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605.1.15 (KHTML, lik · /api/v1/fabric_device_auth/fortigate/init2 IPs2

All families

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

b11cuq082_00050816_8184102b_xd0f1e7f32 headers apart60 IPs664

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.