Amzn-SearchBot

The wire fingerprints traffic claiming to be this crawler presented, split by whether a channel the operator publishes for verification — its IP ranges or forward-confirmed reverse DNS — confirmed the claim.

Claims in window

Same adjudication as the stats page: a claim confirmed by either channel the operator publishes — its IP ranges or forward-confirmed reverse DNS — is legit; one confirmed by neither is spoofed. Operators differ in which channels they offer, and either alone fully identifies. Sources count distinct clients, not traffic. Fingerprint windows below are day-granular, like sources.

observationssourceslegitspoofedspoof rate
4525025100.0%

Fingerprints presented by unconfirmed claims

The impostor inventory: the highest-volume fingerprints wearing this operator's User-Agent that no operator-published channel confirms, per signal. A Match pill here shows known clients measured producing the same fingerprint an impostor presents.

TLS ClientHello (JA4)

fingerprintobservations
t13d131200_f57a46bbacb6_9249cab70c77 41
t13d131300_f57a46bbacb6_1bd98dace775 4

HTTP request (JA4H)

fingerprintobservations
ge11nr05enus_f3bb7aa45ec4_000000000000_000000000000 30
ge11nn05enus_f3bb7aa45ec4_000000000000_000000000000 6
ge11nr060000_6f1c3d56a901_000000000000_000000000000 5
ge11nn060000_6f1c3d56a901_000000000000_000000000000 2
ge11nr040000_e1d2031bdfea_000000000000_000000000000 2

TCP SYN (JA4T)

fingerprintobservations
42600_2-4-8-1-3_1420_9 45

TCP SYN (p0f)

fingerprintobservations
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 42
4:55+9:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 2
4:50+14:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 1