The HTTP clients at the sensors, by request shape

An Akin token is read, not looked up: its middle section lists which of 32 headers the client sent, so two tokens compare by counting the headers they differ by. Paste one from your own logs below. The shapes seen from the most addresses sit one header from each other, and the families are the tools behind several shapes at once.

596 fingerprints, 86 families, 63.4K source addresses, 4.5M requests, last 30 days

How it works and what it found, Library, CLI and spec and the API

Read a token

Paste two tokens separated by a space to see how many headers apart they are and which ones. Hover a cell for its header.

The most common shapes are one header from each other

Start from the shape seen from the most addresses in 30 days, then step to the largest shape exactly one header away, 5 times. The header that changes at each step is named; in the strips, the added header is the ink cell, a dropped one is outlined.

5.9K addressesCensysb11cun040_00040016_aa48e2c8accept-encoding, accept, user-agent, host

- accept

5.1K addressesPalo Altob11cun030_00040012_13ee3d34accept-encoding, user-agent, host

+ connection

4.5K addressesCensysb11cun040_00040013_608dab68connection, accept-encoding, user-agent, host

+ accept

1.3K addressesWebKitb11cun050_00040017_976354f0connection, accept-encoding, accept, user-agent, host

- accept-encoding

439 addressesCryptoHunterb11cun040_00040015_4c87b06econnection, accept, user-agent, host

- connection

3.9K addressesWebKitb11cun030_00040014_54d07b6daccept, user-agent, host

Families: one tool, several request shapes

A family is a shape plus every shape within one header of it that came from the same source addresses. In each row the strip is the token's header map; a dark cell is a header the family head does not send, an outlined cell one it does send and this shape dropped.

b11cuq050_00050812_107c8b82129 addresses, 3.4K requests, 22 shapes

HTTP/1.1, 5 headers, Content-Length body: accept-encoding, user-agent, content-length, content-type, host

asks for/, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php, /lib/terminal-xhr.php, /icecoder/lib/terminal-xhr.php (POST / GET)

asMozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/), Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko), Go-http-client/1.1 and 996 more

ports5101, 443, 21, 8545

fromUS, DE, NL, JP, Psychz Networks, Google LLC, FranTech Solutions

b11cuq050_00050812_107c8b82the family head, Censys129 addr, 2.0K req b11cuq082_00050816_8184102b_xd0f1e7f3+/- accept, next-action, x-middleware-subrequest, browser54 addr, 631 req b11cuq104_00050816_8fb55415_x038e0ee6d0f1e7f3+/- accept, 0ee6, next-action, next-router-state-tree, x-middleware-subrequest, WebKit42 addr, 257 req b11cuq060_00850812_0421ce22+/- soapaction, WebKit8 addr, 42 req b11cuq061_00050812_0421ce22_x48ab+/- spring.cloud.function.routing-expression, WebKit7 addr, 14 req and 17 more shapes on the head token's page

b11cuq060_00050816_84d4cebf281 addresses, 972 requests, 18 shapes

HTTP/1.1, 6 headers, Content-Length body: accept-encoding, accept, user-agent, content-length, content-type, host

asks for/ipp, /psp/CCHIPRD_2/?cmd=login&languageCd=ENG, /boardDataWW.php, /psp/heprod_5/?cmd=login&languageCd=ENG (POST / PATCH)

asMozilla/5.0 zgrab/0.x, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, lik, Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) and 427 more

ports5101, 631, 21, 2375

fromUS, NL, DE, CA, Censys, Inc., Psychz Networks, FranTech Solutions

b11cuq060_00050816_84d4cebfthe family head, zgrab281 addr, 449 req b11cuk105_00050016_5ccac048_x038e8e84d668e7f3ed80+/- content-length, next-action, next-router-state-tree, transfer-encoding, x-nextjs-html-request-id, x-nextjs-request-id, Firefox18 addr, 23 req b11cuq060_00050816_5ad15e38same headers, other value grammar or casing, browser6 addr, 27 req b11cuq070_0005081e_c0f7322a+/- accept-language, Firefox3 addr, 349 req b11cuq060_00050816_8092f713same headers, other value grammar or casing, Firefox3 addr, 11 req and 13 more shapes on the head token's page

b11cun020_00040001_78f1f19c151 addresses, 12.0K requests, 12 shapes

HTTP/1.1, 2 headers, no body: connection, host

asks for/, /abc6, /abc8, /abc7 (GET / CONNECT)

ports443, 8443, 9443, 1337

fromBG, US, GB, AE, Techoff Srv Limited, BL Networks, Pfcloud UG (haftungsbeschrankt)

b11cun020_00040001_78f1f19cthe family head151 addr, 10.9K req b11cun063_40040001_ffe60107_x9f62a4acfdb1+/- upgrade, sec-websocket-key, sec-websocket-protocol, sec-websocket-version18 addr, 251 req b11cuq030_00040801_213543bf+/- content-length3 addr, 17 req b11cun021_00040000_724c10fb_x641c+/- connection, 641c2 addr, 136 req b11cun021_00040000_724c10fb_x7f35+/- connection, 7f352 addr, 136 req and 7 more shapes on the head token's page

b11cuq070_00050817_81cd6514282 addresses, 1.9K requests, 10 shapes

HTTP/1.1, 7 headers, Content-Length body: connection, accept-encoding, accept, user-agent, content-length, content-type, host

asks for/, /spip.php, /wsman, /login (POST / PUT)

asMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, lik, Python WinRM client, Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0 and 66 more

ports5985, 54321, 80, 443

fromSG, US, CN, IN, DigitalOcean, LLC, Microsoft Corporation, CariNet, Inc.

b11cuq070_00050817_81cd6514the family head, WebKit282 addr, 1.8K req b11cuq081_00050817_cb8d62e5_x1af4+/- 1af4, requests7 addr, 12 req b11cdq080_00050817_312cd899same headers, other value grammar or casing, WebKit2 addr, 22 req b11cuq060_00050816_937417e1+/- connection, browser2 addr, 9 req b11cuq080_00050c17_12e4ce34+/- referer, WebKit2 addr, 8 req and 5 more shapes on the head token's page

82 more families with two or more shapes

head token	seen as	shapes	addresses	requests
b11cun080_0005041f_fb294466	WebKit	9	7	5.3K
b11cuq060_00050813_95cc9d02	browser	8	65	6.0K
b11cun040_00040016_4110f156	aiohttp	6	278	175.4K
b11cun030_00040012_f6d8d797	WebKit	6	60	2.4K
b11cun050_00040017_e873236c	ApcosysBot	5	965	4.6K
b11cun050_00040017_6b90553b	WebKit	5	887	9.8K
b11cuq136_80050813_f44850b6_x379753ab95539f8fdafedf99	DuckAssistBo	5	96	672
b11cun050_0004001e_00ecc3a8	WebKit	5	46	9.4K
b11cun030_00040011_c91eaf54	Go	4	918	37.4K
b11cun062_40040011_ffe60107_x9f62fdb1	rawgrab	4	106	1.1K
b11cuq040_00040812_cfad16f7	urllib	4	38	206
b11cun060_0014001d_efa3d503	WebKit	4	24	440
b11cun050_00040413_2619b3ac	WebKit	4	18	786
b11cun060_0004001f_eefe5210	Firefox	4	17	15.5K
b11cun040_00040016_1d05953d	CryptoHunter	4	11	911
b11cuq070_00050817_ae8383eb	bsc-node-rad	4	8	184
b11cun061_00040017_c5b51fcd_xff63	WebKit	4	5	21.7K
b11cun040_00040015_4c87b06e	CryptoHunter	3	439	89.3K
b11cun148_80040017_b6ce16b9_x379753ab95539f8fce00d0f1dafedf99	browser	3	289	17.7K
b11cuq030_00050800_e62b6d85	no UA	3	200	252
b11cuq090_0055081d_9bbac077	WebKit	3	24	139
b11cuq060_00050815_30319a11	CryptoHunter	3	9	53
b11cun060_0004003d_f55b17ef	browser	3	6	1.4M
b11cun070_0014001f_85240426	KrebsOnSecur	3	6	100
b11cuq111_10050c1f_1bc79d45_xff63	Firefox	3	3	35
b11cuq080_10050c13_37cee2c0	Firefox	3	2	183
b11cun150_0004f3ff_28f866c0	Chrome	2	3.7K	7.8K
b11cun120_000c03ff_bacda3cd	Firefox	2	1.9K	3.9K
b11cun050_00040017_976354f0	WebKit	2	1.3K	28.7K
b11cun060_0004001f_561f323a	WebKit	2	417	6.5K
b11cun060_0006001d_3af976da	Chrome	2	223	11.2K
b11cun050_00060013_3ef9a8f6	Chrome	2	144	3.1K
b11cun040_00040016_c1d30083	WebSiphon	2	122	46.6K
b11cun020_00040002_5ff1c0a9	no UA	2	117	1.7K
b11cun050_00040017_97f1d74f	Chrome	2	103	1.9K
b11cun040_00040016_50f90888	WebKit	2	82	577
b11cuq040_00050801_2daa70d6	no UA	2	81	199
b11cun080_0005005f_384a0c90	httpx	2	50	9.6K
b11cun116_80040013_c23366f5_x379753ab95539f8fdafedf99	Palo Alto	2	47	529
b11cun031_00040010_e62b6d85_x518b	browser	2	40	1.3K
b11cun040_00040013_ab9bb075	WebKit	2	40	796
b11cun050_00040017_7e326327	zenox-opendi	2	28	436
b11cun040_0004001c_cdac4f66	WebKit	2	22	100
b11cun040_00140011_5aed6dea	browser	2	21	55
b11cun030_00040011_213543bf	Firefox	2	19	395
b11cuq050_00040813_2619b3ac	WebKit	2	19	332
b11cun061_0004001e_847378c2_xdb05	WebKit	2	17	37
b11cun103_50340011_f5d02f95_x9f62a4acfdb1	WebKit	2	16	1.5K
b11cun030_00040012_f983b7ce	browser	2	15	7.8K
b11cun090_000401fe_0bd93f5d	Firefox	2	14	27
b11cuq070_00050817_9c017ed9	httpx	2	14	605
b11cun050_00050013_2619b3ac	browser	2	12	357
b11cun126_80040017_97192874_x379753ab95539f8fdafedf99	WebKit	2	12	127
b11cun040_08040011_2daa70d6	Chrome	2	11	139
b11cun050_0044001c_d97268c3	WebKit	2	11	372
b11cun130_000473f7_ae219191	Chrome	2	11	19
b10cun010_00000004_a37af9cb	no UA	2	10	1.5K
b11cun040_00040016_f36dd82e	Chrome	2	10	7.7K
b11cun072_00040017_81cd6514_x8e84e7f3	WebKit	2	10	3.3K
b11cuq060_00850812_1a0049ff	browser	2	10	660
b11cun060_00040037_28779db2	Chrome	2	9	83
b11cun121_800405fe_e6286e74_x7092	WebKit	2	9	18
b11cun050_0004001e_0c87f8d1	Firefox	2	8	688
b11cun040_00040016_5d5a81df	browser	2	7	160
b11cun050_08040013_2619b3ac	Firefox	2	7	635
b11cuq050_00050811_9b8c433a	Go	2	7	146
b11cun050_00040017_4032849c	WebKit	2	5	74
b11cun084_40040011_966c00f7_x12be9f62a4acfdb1	CryptoHunter	2	5	275
b11cun040_08040012_cfad16f7	Chrome	2	4	158
b11cun160_003477fe_6d1ef716	WebKit	2	4	4.5K
b11cun199_80040017_dffd43a6_x0e61379753ab60b66a268e1291de95539f8f	WebKit	2	4	60
b11cun040_00040016_28a5ad78	FiveM-Public	2	3	52
b11cun040_00040016_fb523147	WebKit	2	3	42
b11cun050_00040017_27ddf488	browser	2	3	78
b11cuq150_000d7dde_12a3c497	WebKit	2	3	24
b11cun020_10040000_724c10fb	no UA	2	2	34
b11cun061_00040017_e1dbd7f1_x4ce9	ES-ExposureM	2	2	22
b11cun082_04040017_735c1356_x117b3539	AnyConnect	2	2	4
b11cuq060_10040c12_0421ce22	Firefox	2	2	9
b11cuq070_08050c12_b8f6b5c2	WebKit	2	2	16
b11cuq122_0005781e_0a1723a0_xd0f1e7f3	WebKit	2	2	36
b11cuq226_800d79df_73f37caf_x379753ab95539f8fdafedf99	WebKit	2	2	14

Shapes that stay constant while everything else rotates

Many user agents, one shape

The string changes; the request shape does not.

token	seen as	user agents	addresses
b11cun050_0004003c_a47bb3dc	browser, /site.zip	4,631	6
b11cun060_0004003d_f55b17ef	browser, /?phpinfo=-1	4,604	6
b11cun060_0004003d_8084a027	Chrome, /_static/.env	4,548	6
b11cun040_00040013_608dab68	Censys, /favicon.ico	2,364	4.5K
b11cun050_00040017_976354f0	WebKit, /favicon.ico	2,135	1.3K

Many TLS stacks, one shape

The same HTTP client behind different TLS libraries.

token	seen as	TLS fingerprints	addresses
b11cun040_00040013_608dab68	Censys, /favicon.ico	39	4.5K
b11cun030_00040012_13ee3d34	Palo Alto, /	33	5.1K
b11cun050_00040017_6b90553b	WebKit, /	29	887
b11cun040_00040016_aa48e2c8	Censys, /	26	5.9K
b11cun030_00040014_54d07b6d	WebKit, /	25	3.9K

Many ports, one shape

Sweepers that keep one request shape across the port range.

token	seen as	ports	addresses
b11cun040_00040013_608dab68	Censys, /favicon.ico	43,097	4.5K
b11cun010_00040000_c4b2c4aa	no UA, /	33,042	928
b11cun040_00040016_aa48e2c8	Censys, /	32,897	5.9K
b00cun000_00000000_334359b9	no UA, *	25,949	493
b10cun020_00000014_0a8d7f11	Palo Alto, /	24,609	2.0K