Stats

12291 observations in window.

Traffic

Raw request volume vs visit-deduplicated collection. Requests exclude internal monitoring and operator traffic; observation totals here are preserved after raw observations age out of retention.

Signal coverage

Share of observations carrying each signal. Absence is mostly structural — QUIC (HTTP/3) connections carry no TCP SYN or HTTP/2 frame signal, and HTTP/1.1 connections no HTTP/2 frames — occasionally operational, when a signal source was briefly unavailable or not yet deployed at capture time.

Distinct fingerprints

"New" counts fingerprints first seen inside the window; the link lists them ranked by volume.

Distinct clients per day

Distinct IP-hashes per complete UTC day (chart spans the last 22 days, independent of the window above). A client seen over both transports counts in both columns, so tcp + quic can exceed the total.

Bot operator claims

Self-declared bot User-Agents — search and AI crawlers and user-triggered fetchers — checked at ingest against the IP ranges each operator publishes. A match means the source IP is inside the published range — consistent with the real operator; outside ranges and wrong operator are impersonations. Spoof rate is (outside + wrong) ÷ all claims. Counts reflect the selected window (windowed history begins when bot-claim tracking was deployed; all is true all-time). flagged claims →