Nothing unusual about the requests themselves just standard getwork and getblocknumber requests with following headers:
Content-Type: application/json
Host: localhost:8999
Content-Length: 32
Authorization: Basic somebase64rubbish
The only thing out of the ordinary is that the requests are all coming from one address but the client is multithreaded so it's very likely there's many concurrent requests from one address at any one time.
Forgot to mention I'm running the bitcoin daemon on winXP 32 bit.
Also I doubt it should be an issue but I'm using org.json library which creates json strings with newlines (but no indenting) i.e.
{
"id": 1,
"method": "getwork"
}