first seen 2026-06-18 17:16 · last seen 2026-11-02 04:49 · JSON
Last 7 days (26 observations)
Distinct clients per day (last 30 days, peak 5/day)
Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.
Decomposed attributes
SETTINGS
{"2": 0, "4": 10485760}
WINDOW_UPDATE
10420225
PRIORITY frames
0
Pseudo-header order
m,p,a,s
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
0018,0017Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.7, powershell 5.1.26100.33648, curl 8.21.0.The fingerprint page shows the full measured match list. More on the catalog.