It's Go-http-client/1.1

https://x.com/JustineTunney/status/1957130925013442876

https://seclists.org/nanog/2025/Aug/260

Wait how would they observe this? If not owner of the domain, and likely not owner of the client (random residential proxy)? Unless this is HTTP+MITM.

NANOG is the North American Network Operators Group.

femboy.cat is sending HTTP requests from nearly every corner of the Earth.