Processes are disclosed for fingerprinting and identifying client applications based on the analysis of client requests. In an HTTP-based embodiment, a fingerprint is constructed based on the presence and order of HTTP headers included in a request from a client application or device. This fingerprint may then be compared to known fingerprints associated with particular client applications to identify the particular client application and/or to assess whether the client application is malicious. The results of this analysis may, for example, be used to determine how to respond to the current request and/or subsequent requests.