A public, free lookup service for TLS client fingerprints.
Paste a JA3 or JA4 to see what software opened a connection — and, across the domains it reaches, how it behaves. Or look up a domain to see whether it has been reached through a residential proxy network, and by which clients.
- fingerprints
- 1,289
- observations
- 371,447
- domains
- 22,416
How it works
The corpus is built from inside a residential proxy network. We join it as a swarm of peers — decoys that do nothing but listen.
- 1Every session routed through a decoy drags its TLS ClientHello and the domain it is reaching for.
- 2We record the fingerprint and the server name — never the peer’s IP. Just
(fingerprint, SNI). - 3Folded together, millions of these become a reputation: what the software is, and how it behaves across everything it touches.
ALPN offers
ALPN is the one thing you can read off a single handshake. A browser offers h2 then http/1.1, in that order; a library offers http/1.1 or nothing at all. Here is how the corpus splits — by connections, and by the distinct fingerprints behind them.
h2, http/1.168%http/1.116%(none)12%h23%http/1.1, h21%other · 8 more0%
The amber slice is h2, http/1.1 — the browser offer. It carries most of the connections but a smaller share of the fingerprints: a handful of library offers fragment into many distinct stacks.
Who is behind each offer
The amber length is the share we can name; the neutral tail is still anonymous. Browsers cluster in h2, http/1.1; the HTTP-library stacks — Node, Python — show up under http/1.1 and (none).
The graph
Every fingerprint that reached www.google.com, sized by how much traffic it carried. Real browsers cluster; the odd library or bot sits off on its own. This is one slice — explore the whole graph →