Species index / toolkit

node

Operator not identifiable from the User-Agent alone. Identity is self-declared and unverified.

Identity

Bare Node.js HTTP client.

What it went looking for

The order and selection of discovery paths is a design fingerprint: it reflects which conventions whoever built this client decided to support.

Protocol fingerprint

TLS client fingerprint

Captured off the wire before the proxy terminates TLS. JA4 is stable across IP changes and much harder to spoof than a User-Agent string, so it is the strongest identity signal on this page.

Header order

The order a client sends its HTTP headers in is a design fingerprint of the library that built the request. Captured on plaintext port 80 only, since the proxy normalises order before the application sees it.

1. host
2. connection
3. accept
4. accept-language
5. sec-fetch-mode
6. user-agent
7. accept-encoding

Requests per day (60 days)