Fingerprint clusters

One row per header signature, with the count of distinct addresses that shared it. This is the view the product was built around.

Each row is a header fingerprint — a hash of the header tuple a client sends, deliberately excluding the address — with the number of distinct addresses behind it, the session count and its span in time. Expanding a row lists the member addresses and their networks.

The card above the table is prose and is rendered server-side; making it wait on a request would be theatre. Re-sorting or changing the minimum-address floor re-runs the one card, and expanding a row issues a request for that fingerprint only.

• Are the networks unrelated? Five addresses in one hosting provider is a fleet on rented boxes. Five addresses on five different consumer ISPs is a residential proxy pool, which is the harder and more expensive kind.
• Are the timestamps clustered? Several addresses beginning a session in the same second is the tell that no amount of address rotation hides.
• Is it a carrier? Mobile networks are excluded from the rule because carrier-grade NAT genuinely puts thousands of real people behind a handful of addresses — but a network misclassified as something else will show up here anyway. Check the network type before concluding anything.
• Is it a verified crawler? A search crawler legitimately crawls from a large address pool with one fingerprint, and is excluded from the rule for that reason.

• The distinct-address count is approximate above about a hundred. It comes from Solr’s distinct-value function, which is exact below roughly that and estimated above it. The caption says so, because it is a number the product presents as evidence.
• On a shared index pair the cluster spans every site in it, deliberately. A rotating fleet working through your sites in turn is exactly the pattern that is invisible from inside any one of them — which does mean the rule fires more readily on a shared pair. It is worth 80 points and that reaches the bot threshold on its own, so raise scoring.fp_fleet_min_ips if your audience genuinely is many people behind few addresses. See joining a pair.

How much a fingerprint is worth at all depends directly on how many headers you log. With the recommended format the tuple has eleven components and is highly discriminating; with plain combined it collapses to two, and a fleet that rotates its browser version splits into clusters that each fall below the floor. The fingerprint page has the measured example.