Meta

The wire fingerprints traffic claiming this operator's crawlers presented, split by whether the claim is consistent with the network the operator publishes as its own. Meta documents its crawler User-Agents and a network retrieval procedure — AS32934 route objects it maintains in the RADb registry — but no crawler-specific IP list, so membership confirms operator origin, while a claim from outside is unverified: an anomaly, not proof of spoofing.

Claims in window

Same adjudication as the stats page, under this operator's published channel: a claim from inside the network the operator publishes as its own is consistent with operator origin; one from outside is unverified — inconsistent with the published network, but not a confirmed fake, because the operator does not state that set is exhaustive crawler egress. A claim from inside a different operator's published crawler range is a strong impersonation signal. Sources count distinct clients, not traffic. Fingerprint windows below are day-granular, like sources.

observationssourcesconsistentoutside networkforeign crawler rangeunconfirmed rate
3030314671465200.1%

Fingerprints presented by confirmed traffic

The highest-volume fingerprints the operator's own traffic runs, per signal — claims confirmed via operator-published channels (here: membership of the operator's published network). A Match pill marks an exact match against a controlled capture — an association with known stacks, not an identity verdict: unrelated clients built on the same stack can legitimately share a fingerprint.

TLS ClientHello (JA4)

fingerprintobservations
t13d3111h2_e8f1e7e78f70_5ac7197df9d2 30298

HTTP request (JA4H)

fingerprintobservations
ge20nn030000_80b089f68b8e_000000000000_000000000000 18058
ge20nn09enus_c5abe4666a67_000000000000_000000000000 6728
ge20nn020000_e5a56608905c_000000000000_000000000000 3554
ge20nn070000_1903711a2262_000000000000_000000000000 1448
ge20nn11enus_08fd186dd996_000000000000_000000000000 288
ge20nn040000_3dccbaa13f05_000000000000_000000000000 169
ge20nn030000_0d4c7aba53a3_000000000000_000000000000 34
ge20nr07enus_7226337734ed_000000000000_000000000000 10
ge20nr09enus_733a0f80b52d_000000000000_000000000000 6
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.18.0, +9 more.The fingerprint page shows the full measured match list. More on the catalog. 3

HTTP/2 frames (Akamai)

fingerprintobservations
1:4096;2:0;5:16384;6:131072;3:100;4:65536|26148865|0|m,s,p,a 20138
1:4096;2:0;5:16384;6:131072;3:100;4:65536;11105:65535;11106:65535;11107:65535;11108:10;11109:10|26148865|0|m,s,p,a 10160

TCP SYN (JA4T)

fingerprintobservations
65535_2-4-8-1-3_1380_8 30298

TCP SYN (p0f)

fingerprintobservations
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 23031
6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0 3725
6:55+9:0:1380:65535,8:mss,sok,ts,nop,ws::0 1026
6:46+18:0:1380:65535,8:mss,sok,ts,nop,ws::0 685
6:53+11:0:1380:65535,8:mss,sok,ts,nop,ws::0 624
6:49+15:0:1380:65535,8:mss,sok,ts,nop,ws::0 610
6:47+17:0:1380:65535,8:mss,sok,ts,nop,ws::0 119
6:52+12:0:1380:65535,8:mss,sok,ts,nop,ws::0 86
6:48+16:0:1380:65535,8:mss,sok,ts,nop,ws::0 70
6:247+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 63

Fingerprints presented by unconfirmed claims

Unverified claims: the highest-volume fingerprints wearing this operator's User-Agents from outside its entire published network, per signal. This inventory combines outside-network anomalies — not a proven-impostor list, since the operator does not state its published network is exhaustive crawler egress — with any claims from inside a different operator's published crawler range, which are strong impersonation signals, itemized with their own evidence under flagged claims. A Match pill shows known clients measured producing the same fingerprint.

TLS ClientHello (JA4)

fingerprintobservations
t13d131300_f57a46bbacb6_1bd98dace775 3
t13d131200_f57a46bbacb6_9249cab70c77 2

HTTP request (JA4H)

fingerprintobservations
ge11nr05enus_f3bb7aa45ec4_000000000000_000000000000 2
ge11nr040000_e1d2031bdfea_000000000000_000000000000 1
po11nn060000_a35477c4bdb5_000000000000_000000000000 1
po11nn090000_d19993cb819f_000000000000_000000000000 1

TCP SYN (JA4T)

fingerprintobservations
42600_2-4-8-1-3_1420_9 3
43200_2-4-8-1-3_1440_9 2

TCP SYN (p0f)

fingerprintobservations
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 3
6:46+18:0:1440:mss*30,9:mss,sok,ts,nop,ws:flow:0 2