Insights

A real audience is never even

Client populations are power laws. On any domain with real traffic the busiest stack carries far more than its 1/N share — a browser version everyone is on, an SDK every app embeds. So multiply the top stack's share by the number of stacks and organic endpoints land in double digits.

A value near 1 means every stack carried the same load. No audience does that. A roster of profiles being rotated does exactly that.

Only domains with at least ten distinct stacks are ranked. Below that the statistic is arithmetic rather than evidence: with five stacks even a thoroughly dominated endpoint scores low, because there is nothing for the load to be uneven across.

The fingerprint count overstates client diversity

A JA4 is three parts. ja4_b is the cipher list and ja4_c the extensions and signature algorithms — those belong to the client. ja4_a carries the TLS version, the cipher and extension counts, and the ALPN offered — and ALPN is a fact about the destination: a browser offers h3 only where it has learned QUIC works, and http/1.1 alone where it knows there is no h2. One browser build therefore appears under several JA4s.

distinct JA4

2,377

client buildsja4_b + ja4_c

2,057

extension setsja4_c

872

cipher listsja4_b

1,171

13% of the JA4 rows are a client already counted, seen through a different destination. Group by ja4_b + ja4_c when you want clients; keep the whole JA4 when you want sightings.

One stack, a lot of traffic

The other end of the same axis. Volume behind a single client stack is one operator, not an audience — the corpus cannot say who, but it can say there was only ever one of them.

What the traffic is made of

Grouped by cipher list, which is a property of the TLS library build and passes through unchanged to everything using it — so one row here covers a whole family of clients. Named from the same catalogue the fingerprint pages use.

A high JA4-row count against one cipher list is the collapse above, seen from the other side: many destinations, one client family. An unnamed row is a cipher list the catalogue has not been taught yet, not an unknown client.