Meta

The wire fingerprints traffic claiming this operator's crawlers presented, split by whether the claim is consistent with the network the operator publishes as its own. Meta documents its crawler User-Agents and a network retrieval procedure — AS32934 route objects it maintains in the RADb registry — but no crawler-specific IP list, so membership confirms operator origin, while a claim from outside is unverified: an anomaly, not proof of spoofing.

Claims in window

Same adjudication as the stats page, under this operator's published channel: a claim from inside the network the operator publishes as its own is verified — consistent with operator origin; one from outside is unverified — inconsistent with the published network, but not a confirmed fake, because the operator does not state that set is exhaustive crawler egress. A claim from inside a different operator's published crawler range is a strong impersonation signal. Sources count distinct clients, not traffic. Fingerprint windows below are day-granular, like sources.

observationssourcesverifiedunverifiedunverified rate
218561324132130.2%

Fingerprints presented by confirmed traffic

The highest-volume fingerprints the operator's own traffic runs, per signal — claims confirmed via operator-published channels (here: membership of the operator's published network). A Match pill marks an exact match against a controlled capture — an association with known stacks, not an identity verdict: unrelated clients built on the same stack can legitimately share a fingerprint.

TLS ClientHello (JA4)

fingerprintobservations
t13d3111h2_e8f1e7e78f70_5ac7197df9d2 21865
t13d2212h1_3522af84f765_8d633dac7124 1

HTTP request (JA4H)

fingerprintobservations
ge20nn09enus_c5abe4666a67_000000000000_000000000000 11105
ge20nn030000_80b089f68b8e_000000000000_000000000000 5504
ge20nn030000_6dac75bd47eb_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog. 5116
ge20nn040000_3dccbaa13f05_000000000000_000000000000 127
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.13.0, +11 more.The fingerprint page shows the full measured match list. More on the catalog. 7
ge20nr07enus_7226337734ed_000000000000_000000000000 6
ge11nn050000_9caab87a0805_000000000000_000000000000 1

HTTP/2 frames (Akamai)

fingerprintobservations
1:4096;2:0;5:16384;6:131072;3:100;4:65536|26148865|0|m,s,p,a 21865

TCP SYN (JA4T)

fingerprintobservations
65535_2-4-8-1-3_1380_8 21866

TCP SYN (p0f)

fingerprintobservations
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 17093
6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0 1940
6:46+18:0:1380:65535,8:mss,sok,ts,nop,ws::0 784
6:48+16:0:1380:65535,8:mss,sok,ts,nop,ws::0 690
6:53+11:0:1380:65535,8:mss,sok,ts,nop,ws::0 574
6:55+9:0:1380:65535,8:mss,sok,ts,nop,ws::0 378
6:54+10:0:1380:65535,8:mss,sok,ts,nop,ws::0 121
6:47+17:0:1380:65535,8:mss,sok,ts,nop,ws::0 94
6:247+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 55
4:83+?:0:1380:65535,8:mss,sok,ts,nop,ws:df,id+:0 33

Fingerprints presented by unverified claims

Unverified claims: the highest-volume fingerprints wearing this operator's User-Agents from outside its entire published network, per signal. This inventory combines outside-network anomalies — not a proven-impostor list, since the operator does not state its published network is exhaustive crawler egress — with any claims from inside a different operator's published crawler range, which are strong impersonation signals, itemized with their own evidence under flagged claims. A Match pill shows known clients measured producing the same fingerprint.

TLS ClientHello (JA4)

fingerprintobservations
t13d1611h2_a2dbe2762f31_5ac7197df9d2 3

HTTP request (JA4H)

fingerprintobservations
ge20nn030000_80b089f68b8e_000000000000_000000000000 3

HTTP/2 frames (Akamai)

fingerprintobservations
1:4096;2:0;5:16384;6:131072;4:1048576|10420225|0|m,s,p,a 3

TCP SYN (JA4T)

fingerprintobservations
65535_2-4-8-1-3_1460_9 2
65535_2-4-8-1-3_1360_13 1

TCP SYN (p0f)

fingerprintobservations
4:55+9:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 1
4:59+5:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 1
6:54+10:0:1360:65535,13:mss,sok,ts,nop,ws:flow:0 1