HoneyLabs

HTTP request fingerprints

What is knocking, by the shape of its request

Every HTTP request the sensors see gets an Akin token. Its middle section is a presence bitmap over a published vocabulary of 32 request headers, so two tokens can be compared directly: the number of differing bits is the number of headers the two clients differ by. The User-Agent string and the request path are left out on purpose; both were measured changing within a single operator. That is why one scanner rotating hundreds of user agents is one row below, and why a tool's GET and POST variants sit one bit apart.

115

fingerprints, 30 days

20

families of shapes

9.3K

source addresses

65.4K

requests

4

sensors reporting

550

requests per sensor-day

Read a fingerprint

Paste any token. Paste two, separated by a space, and it tells you how many headers apart they are and which ones.

Header presence, one row per fingerprint, one column per vocabulary header

Rows with the same coloured edge are one family: one tool, several request shapes. A filled square means the header was present. Hover a row for its top user agent.

fingerprint · click a header to filter
accept
connection
accept-encoding
host
accept-language
upgrade-insecure-requests
user-agent
range
cache-control
content-length
content-type
sec-fetch-mode
pragma
sec-fetch-dest
sec-fetch-site
sec-fetch-user
metadata-flavor
metadata
sec-ch-ua-platform
sec-ch-ua-mobile
sec-ch-ua
x-requested-with
referer
accept-charset
x-csrf-token
proxy-authorization
origin
wsmanidentify
sec-gpc
upgrade
sec-websocket-version
sec-websocket-key
a11cun020_00000048_724c10fb · 83 IPs · 69 UAs
a11cuq030_00000248_e62b6d85 · 3 IPs · 2 UAs
a11cun060_0000007b_f55b17ef · 2 IPs · 13 UAs
a11cun050_00000079_a47bb3dc · 2 IPs · 13 UAs
a11cun060_0000007b_8084a027 · 2 IPs · 13 UAs
a11cun040_0000004d_aa48e2c8 · 1.4K IPs · 210 UAs
a11cun050_0000004f_0d8a8ff5 · 77 IPs · 57 UAs
a11cun030_0000004a_c91eaf54 · 56 IPs · 13 UAs
a11cun040_0000004b_a4cdfabf · 2 IPs · 2 UAs
a11cun050_0000004f_af924659 · 29 IPs · 2 UAs
a11cun040_0000004d_c2bd490f · 29 IPs · 2 UAs
a11cun040_0000004d_4110f156 · 10 IPs · 7 UAs
a11cun050_0000005d_fecf3944 · 3 IPs · 3 UAs
a11cun030_0000004c_13ee3d34 · 1.7K IPs · 74 UAs
a10cun020_00000041_0a8d7f11 · 1.4K IPs · 16 UAs
a11cun030_00000049_54d07b6d · 564 IPs · 17 UAs
a11cun040_0000004e_608dab68 · 442 IPs · 202 UAs
a11cun040_0000004e_36fbce14 · 296 IPs · 6 UAs
a11cun040_0000004b_4c87b06e · 113 IPs · 6 UAs
a11cun050_0000005d_361dcb62 · 90 IPs · 2 UAs
a11cun050_0000004f_90cbaab3 · 49 IPs · 2 UAs

One fingerprint, many user agents

The string changes; the request shape does not.

a11cun040_0000004d_aa48e2c8210 user agents · 1.4K IPsa11cun040_0000004e_608dab68202 user agents · 442 IPsa11cun030_0000004c_13ee3d3474 user agents · 1.7K IPsa11cun020_00000048_724c10fb69 user agents · 83 IPsa11cun050_0000004f_0d8a8ff557 user agents · 77 IPs

One fingerprint, many TLS stacks

The same HTTP client behind different TLS libraries.

a11cun040_0000004d_aa48e2c89 TLS fingerprints · 1.4K IPsa11cun030_0000004c_13ee3d349 TLS fingerprints · 1.7K IPsa11cun040_0000004e_608dab688 TLS fingerprints · 442 IPsa11cun030_00000049_54d07b6d7 TLS fingerprints · 564 IPsa11cun020_00000048_724c10fb5 TLS fingerprints · 83 IPs

One fingerprint, many ports

Sweepers that keep one request shape across the port range.

a10cun020_00000041_0a8d7f117428 ports · 1.4K IPsa11cun030_0000004c_13ee3d342642 ports · 1.7K IPsa11cun050_0000005b_09001b3e1896 ports · 963 IPsa11cun040_0000004d_aa48e2c81661 ports · 1.4K IPsa11cun040_0000004e_608dab681440 ports · 442 IPs

Families

A fingerprint plus every shape within one header of it that comes from the same source addresses. The differing headers are named, because the token carries them.

a11cun020_00000048_724c10fbwhat-vpn-go/0.1shapes differ by: content-length4 shapes83 IPsa11cun060_0000007b_f55b17efMozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0; yie10)shapes differ by: connection3 shapes2 IPsa11cun040_0000004d_aa48e2c8Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)shapes differ by: value grammar only2 shapes1.4K IPsa10cun020_0000000a_78f1f19cshapes differ by: connection2 shapes100 IPsa11cun050_0000004f_0d8a8ff5Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36shapes differ by: value grammar only2 shapes77 IPsa11cun060_0080005b_3af976daMozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.shapes differ by: referer2 shapes74 IPsa11cun030_0000004a_c91eaf54Go-http-client/1.1shapes differ by: accept2 shapes56 IPsa11cun150_101ce87f_80239852Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/14shapes differ by: referer2 shapes46 IPsa11cun080_00000c5f_a498732epython-httpx/0.28.1shapes differ by: content-length2 shapes45 IPsa11cun121_0000e87f_84206899Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0shapes differ by: referer2 shapes30 IPsa11cun050_0000004f_af924659Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)shapes differ by: connection2 shapes29 IPsa11cun040_0000004d_4110f156Python/3.10 aiohttp/3.8.4shapes differ by: accept-language2 shapes10 IPsa11cun050_0000006b_bd5c72d1libredtail-httpshapes differ by: value grammar only2 shapes8 IPsa11cun149_0000004f_abf74e9dMozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)shapes differ by: value grammar only2 shapes7 IPsa10cun020_00000009_be1ad017shapes differ by: host2 shapes6 IPsa11cun020_0000000c_5ff1c0a9shapes differ by: connection2 shapes6 IPsa11cun160_005cf97d_7acbd9b1Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like shapes differ by: value grammar only2 shapes4 IPsa10cun030_00000049_54d07b6dMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36shapes differ by: accept2 shapes3 IPsa11cun040_0000044a_bf8a4cbbGo-http-client/1.1shapes differ by: content-length2 shapes3 IPsa11cun060_0000005f_720361ccMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)shapes differ by: accept-language2 shapes2 IPs