Updates & Status

The "cluster by structural distance" groups verbosus fingerprints that are structurally close - a weighted count of differing demangled fields, per probe, so a status-code change can count differently from a reason-phrase change. Paste or upload the fingerprints; each group is a set that is all mutually at the same distance.

Use it in conjunction with the cluster by tags feature; Get all the unique fingerprints and paste them in the Verbosus fingerprints input box, configure all the required parameters as you like, and get a JSON object with all the clustered groups.

Added Feedback page for reporting bugs, feature/improvements requests or anything else you might want to share.

Added the capability to query all unique tags and knowing what's already in the live DB so that it is easier to cluster by tags.

Updated the compare function to account for the differences in the "Connection" header per relevant probe (p2/p3/p4/p5/p7a), instead of checking for the final connection header fingerprint (ka and cl) across all probes.

The Statistics tab displays (top 10) a periodic snapshot of the HTTP-Basma database: fingerprint distributions, ports, tags, SSL usage, and dead-probe counts. The snapshot is collected automatically on a schedule. For now, it is configured to query the database twice per day, at 00:00 AM and 12:00 PM Toronto time.

• HTTP-Basma - Platform Update (v3.2 - Dolomites)

• There has been some improvement on the backend server for better performance

• A new cluster feature (tab Cluster): Groups the database servers that match a set of tags by their verbosus fingerprint. Each cluster is one unique fingerprint shared by a set of servers, which surfaces reused infrastructure at a glance. Enter tags, pick the AND/OR operator, and optionally cap Max clusters and Max servers / cluster (0 = no limit). Results lead with a summary (total clusters, total servers across all clusters, the tags searched), then a size-ranked bar chart: one collapsible card per cluster, sorted largest-first, each with a proportional bar and its server count. An Expand/Collapse all control toggles every cluster.
• Because a cluster can hold thousands of servers, expanding a card lazily renders a summary-first view rather than a raw dump: the full verbosus fingerprint (with copy), then stat chips (servers shown/total, distinct hosts, SSL split, count with a path) and a Ports dropdown listing every distinct port with its count (so a cluster spanning many ports lists them all instead of overflowing an inline chip; picking a port filters the list to it). Below that, a filter box narrows the list — combinable with the port selection — and the servers load in chunks of 150 (“Show 150 more”); each row shows SSL state, server (IDN shown as Punycode (Unicode); raw IPs shown as-is), port, and path. An Export CSV button downloads the cluster's servers (server, path, port, is_ssl) for offline analysis.

• A new "Auto-resolve tags" feature in the Fingerprint tab: An Auto-resolve tags button looks the server/domain up on VirusTotal on demand and drops the result into the Tags box.

Please refer to the release notes at https://blog.netomize.ca/http-basma-platform-update-v3-0-gaudi for more information.
In today's release, we've enhanced the live version with new features designed to assist the broader community in contributing to and maintaining a public database of all fingerprints fetched by any platform user.

HTTP-Basma is now live. Fingerprint servers, demangle and compare verbosus fingerprints, and search the database for matches.