Species index / toolkit
curl
Operator not identifiable from the User-Agent alone. Identity is self-declared and unverified.
286Requests
5Distinct IPs
48Well-known probes
2026-08-19First seen
2026-10-04Last seen
Identity
| Kind | agent |
|---|---|
| Family | toolkit |
| Stated purpose | unknown |
| UA match | curl/ |
| Verified | no |
| robots.txt | ignores |
What it went looking for
The order and selection of discovery paths is a design fingerprint: it reflects which conventions whoever built this client decided to support.
| Path | Hits | First | Last |
|---|---|---|---|
/sitemap.xml | 72 | 2026-08-19 | 2026-10-03 |
/llms.txt | 33 | 2026-08-19 | 2026-09-27 |
/.well-known/fomite.json | 18 | 2026-08-19 | 2026-08-22 |
/robots.txt | 9 | 2026-08-19 | 2026-09-29 |
/llms-full.txt | 8 | 2026-08-19 | 2026-09-21 |
/openapi.json | 8 | 2026-08-19 | 2026-09-01 |
/.well-known/oauth-authorization-server | 7 | 2026-08-28 | 2026-10-01 |
/ai.txt | 7 | 2026-08-19 | 2026-08-24 |
/.well-known/oauth-protected-resource | 7 | 2026-08-20 | 2026-09-28 |
/.well-known/mcp.json | 6 | 2026-08-19 | 2026-08-25 |
/.well-known/security.txt | 6 | 2026-08-19 | 2026-08-24 |
/.well-known/mcp-manifest-attestation | 5 | 2026-08-22 | 2026-09-15 |
/.well-known/agent.json | 4 | 2026-08-19 | 2026-08-22 |
/.well-known/oauth-protected-resource/mcp | 3 | 2026-08-20 | 2026-08-28 |
/.well-known/oauth-authorization-server/mcp | 2 | 2026-08-20 | 2026-08-20 |
/.well-known/glama.json | 2 | 2026-08-19 | 2026-08-22 |
/.well-known/ai-plugin.json | 2 | 2026-08-19 | 2026-08-22 |
Protocol fingerprint
| HTTP | TLS | Cipher | ALPN | Requests |
|---|---|---|---|---|
| HTTP/1.1 | TLS1.3 | TLS_AES_128_GCM_SHA256 | http/1.1 | 757 |
| HTTP/2.0 | TLS1.3 | TLS_AES_128_GCM_SHA256 | h2 | 359 |
| HTTP/2.0 | TLS1.3 | TLS_CHACHA20_POLY1305_SHA256 | h2 | 22 |
| HTTP/1.1 | -- | -- | -- | 16 |
| HTTP/1.1 | TLS1.3 | TLS_AES_128_GCM_SHA256 | -- | 10 |
| HTTP/2.0 | TLS1.2 | ECDHE-ECDSA-AES128-GCM-SHA256 | h2 | 2 |
| HTTP/1.1 | TLS1.2 | ECDHE-ECDSA-CHACHA20-POLY1305 | -- | 1 |
TLS client fingerprint
Captured off the wire before the proxy terminates TLS. JA4 is stable across IP changes and much harder to spoof than a User-Agent string, so it is the strongest identity signal on this page.
| JA4 | JA3 | TLS | ALPN | Seen |
|---|---|---|---|---|
| t13d3112h2_e8f1e7e78f70_b26ce05bbdd6 | 0149f47eabf9a20d... | 13 | h2,http/1.1 | 59 |
| t13d2013h1_2b729b4bf6f3_e24568c0d440 | fae0e5d973c96ae1... | 13 | http/1.1 | 56 |
| t13d4907h2_0d8feac7bc37_7395dae3b2f3 | 375c6162a492dfbf... | 13 | h2,http/1.1 | 12 |
| t13d3013h2_1d37bd780c83_8537cf56674e | 32e4b8812cda0c0d... | 13 | h2,http/1.1 | 10 |
| t13d9013h2_c6771aded2ed_57a60bdf03d1 | c654189f0cbcfb63... | 13 | h2,http/1.1 | 3 |
| t13d3013h2_1d37bd780c83_8537cf56674e | 7a73fb0bdeaa2a79... | 13 | h2,http/1.1 | 3 |
Header order
The order a client sends its HTTP headers in is a design fingerprint of the library that built the request. Captured on plaintext port 80 only, since the proxy normalises order before the application sees it.
1. Host 2. User-Agent 3. Accept
seen 6x
1. Host 2. User-Agent 3. Accept 4. Accept-Encoding
seen 3x
1. User-Agent 2. Host 3. Accept
seen 3x
1. Host 2. User-Agent 3. Connection
seen 2x
Requests per day (60 days)
| Day | Requests | |
|---|---|---|
| 2026-08-19 | 73 | |
| 2026-08-20 | 3 | |
| 2026-08-21 | 1 | |
| 2026-08-22 | 11 | |
| 2026-08-23 | 9 | |
| 2026-08-24 | 4 | |
| 2026-08-25 | 2 | |
| 2026-08-26 | 1 | |
| 2026-08-27 | 1 | |
| 2026-08-28 | 1 | |
| 2026-08-29 | 12 | |
| 2026-08-30 | 2 | |
| 2026-08-31 | 1 | |
| 2026-09-01 | 2 | |
| 2026-09-02 | 1 | |
| 2026-09-03 | 1 | |
| 2026-09-04 | 1 | |
| 2026-09-05 | 1 | |
| 2026-09-06 | 1 | |
| 2026-09-07 | 1 | |
| 2026-09-08 | 1 | |
| 2026-09-09 | 1 | |
| 2026-09-10 | 1 | |
| 2026-09-11 | 1 | |
| 2026-09-12 | 1 | |
| 2026-09-13 | 6 | |
| 2026-09-14 | 1 | |
| 2026-09-15 | 18 | |
| 2026-09-16 | 44 | |
| 2026-09-17 | 1 | |
| 2026-09-18 | 1 | |
| 2026-09-19 | 11 | |
| 2026-09-20 | 2 | |
| 2026-09-21 | 1 | |
| 2026-09-22 | 6 | |
| 2026-09-23 | 6 | |
| 2026-09-24 | 1 | |
| 2026-09-25 | 3 | |
| 2026-09-26 | 5 | |
| 2026-09-27 | 8 | |
| 2026-09-28 | 8 | |
| 2026-09-29 | 6 | |
| 2026-09-30 | 13 | |
| 2026-10-01 | 5 | |
| 2026-10-02 | 2 | |
| 2026-10-03 | 4 |