HTTP request fingerprints
What is knocking, by the shape of its request
Every HTTP request the sensors see gets an Akin token. Its middle section is a presence bitmap over a published vocabulary of 32 request headers, so two tokens can be compared directly: the number of differing bits is the number of headers the two clients differ by. The User-Agent string and the request path are left out on purpose; both were measured changing within a single operator. That is why one scanner rotating hundreds of user agents is one row below, and why a tool's GET and POST variants sit one bit apart.
115
fingerprints, 30 days
20
families of shapes
9.3K
source addresses
65.4K
requests
4
sensors reporting
550
requests per sensor-day
Read a fingerprint
Paste any token. Paste two, separated by a space, and it tells you how many headers apart they are and which ones.
Header presence, one row per fingerprint, one column per vocabulary header
Rows with the same coloured edge are one family: one tool, several request shapes. A filled square means the header was present. Hover a row for its top user agent.
One fingerprint, many user agents
The string changes; the request shape does not.
a11cun040_0000004d_aa48e2c8210 user agents · 1.4K IPsa11cun040_0000004e_608dab68202 user agents · 442 IPsa11cun030_0000004c_13ee3d3474 user agents · 1.7K IPsa11cun020_00000048_724c10fb69 user agents · 83 IPsa11cun050_0000004f_0d8a8ff557 user agents · 77 IPsOne fingerprint, many TLS stacks
The same HTTP client behind different TLS libraries.
a11cun040_0000004d_aa48e2c89 TLS fingerprints · 1.4K IPsa11cun030_0000004c_13ee3d349 TLS fingerprints · 1.7K IPsa11cun040_0000004e_608dab688 TLS fingerprints · 442 IPsa11cun030_00000049_54d07b6d7 TLS fingerprints · 564 IPsa11cun020_00000048_724c10fb5 TLS fingerprints · 83 IPsOne fingerprint, many ports
Sweepers that keep one request shape across the port range.
a10cun020_00000041_0a8d7f117428 ports · 1.4K IPsa11cun030_0000004c_13ee3d342642 ports · 1.7K IPsa11cun050_0000005b_09001b3e1896 ports · 963 IPsa11cun040_0000004d_aa48e2c81661 ports · 1.4K IPsa11cun040_0000004e_608dab681440 ports · 442 IPsFamilies
A fingerprint plus every shape within one header of it that comes from the same source addresses. The differing headers are named, because the token carries them.