{
  "$schema":     "https://nikaproxy.com/schemas/tcp-fingerprint-survey/v1.json",
  "dataset_id":  "2026-q2",
  "title":       "The State of TCP Fingerprints in the Residential Proxy Market — 2026 Q2",
  "publisher":   "NikaProxy",
  "url":         "https://github.com/Nika-Proxy/tls-fingerprint-research",
  "license":     "CC BY 4.0",
  "citation":    "NikaProxy. \"The State of TCP Fingerprints in the Residential Proxy Market, Q2 2026.\" github.com/Nika-Proxy/tls-fingerprint-research.",

  "sample": {
    "first_probe_utc":   "2026-05-06T21:50:36Z",
    "last_probe_utc":    "2026-05-19T15:33:34Z",
    "duration_days":     12.74,
    "distinct_exits":    10229,
    "distinct_families": 16,
    "distinct_countries": 22
  },

  "geographic_bias_disclosure": {
    "note": "The 2026-Q2 sample is heavily US-biased (90% of probes). The device-family distribution below represents the US residential pool. Q3 will widen geographic coverage.",
    "country_distribution": {
      "US": { "exits": 9179, "pct_of_sample": 89.7 },
      "IN": { "exits":    6, "pct_of_sample":  0.1 },
      "ID": { "exits":    3, "pct_of_sample":  0.0 },
      "CA": { "exits":    3, "pct_of_sample":  0.0 },
      "VN": { "exits":    2, "pct_of_sample":  0.0 },
      "BR": { "exits":    2, "pct_of_sample":  0.0 },
      "GB": { "exits":    2, "pct_of_sample":  0.0 },
      "JM": { "exits":    2, "pct_of_sample":  0.0 },
      "KN": { "exits":    2, "pct_of_sample":  0.0 },
      "PH": { "exits":    2, "pct_of_sample":  0.0 },
      "long_tail_total": { "exits": 1026, "pct_of_sample": 10.0, "note": "ungeo-located or single-digit country buckets" }
    }
  },

  "device_family_distribution": {
    "android_stock": {
      "exits": 8370,
      "pct":   81.8,
      "category": "android",
      "notes": "Modern Android (10-15) on stock OEM stacks — Samsung, Pixel, Xiaomi, Oppo, Vivo. The dominant family across nearly every residential pool worldwide."
    },
    "linux_generic": {
      "exits": 771,
      "pct":   7.5,
      "category": "linux",
      "notes": "Desktop Linux, Linux servers behind consumer NAT, and some Android variants that strip distinguishing TCP options. Highest false-positive risk family."
    },
    "win11": {
      "exits": 570,
      "pct":   5.6,
      "category": "windows",
      "notes": "Windows 11 desktops. Targeted by anti-bot vendors as the 'normal' desktop browser fingerprint; scarce in residential pools because most residential connections are mobile."
    },
    "ios_legacy": {
      "exits": 239,
      "pct":   2.3,
      "category": "ios",
      "notes": "iOS 13-15 fingerprints. Newer iOS (16+) doesn't reliably show up via residential routing — Apple's mobile carrier NAT topology obscures it."
    },
    "unknown": {
      "exits": 72,
      "pct":   0.7,
      "category": "unclassified",
      "notes": "Signatures that don't match any reference within tolerance. A healthy classifier sits below 1%; we're at 0.7%."
    },
    "amazon_amazon_echo_show_5": {
      "exits": 62,
      "pct":   0.6,
      "category": "iot",
      "notes": "Echo Show smart displays. Surfaces because some residential SDK monetisation reaches IoT devices on home networks; harmless for scraping but flag-worthy if the destination expects a browser."
    },
    "android_10": {
      "exits": 55,
      "pct":   0.5,
      "category": "android",
      "notes": "Android 10 specifically (separated from android_stock when the TCP signature retains pre-12 distinctives)."
    },
    "windows_10": {
      "exits": 44,
      "pct":   0.4,
      "category": "windows",
      "notes": "Windows 10 desktops. Combined with win11 = ~6% of pool — the entire desktop Windows population."
    },
    "win_generic": {
      "exits": 15,
      "pct":   0.1,
      "category": "windows",
      "notes": "Windows signatures that don't pin to a specific version."
    },
    "windows_7": {
      "exits": 15,
      "pct":   0.1,
      "category": "windows",
      "notes": "Yes, Windows 7 is still out there. Mostly behind enterprise NATs that survived as residential through ISP reclassification."
    },
    "nsx_6.5": {
      "exits": 6,
      "pct":   0.1,
      "category": "network_appliance",
      "notes": "VMware NSX appliance signatures — virtualisation infrastructure misrouted as residential by the upstream provider."
    },
    "android_7.0": {
      "exits": 4,
      "pct":   0.04,
      "category": "android"
    },
    "windows_xp": {
      "exits": 2,
      "pct":   0.02,
      "category": "windows",
      "notes": "XP. In 2026. Yes."
    },
    "android_samsung": {
      "exits": 2,
      "pct":   0.02,
      "category": "android"
    },
    "android14": {
      "exits": 1,
      "pct":   0.01,
      "category": "android"
    },
    "linux": {
      "exits": 1,
      "pct":   0.01,
      "category": "linux"
    }
  },

  "rolled_up_by_category": {
    "android":            { "exits": 8433, "pct": 82.4, "comment": "Sum of all android_* families" },
    "windows":            { "exits":  646, "pct":  6.3, "comment": "Sum of win11 + windows_10 + win_generic + windows_7 + windows_xp" },
    "linux":              { "exits":  772, "pct":  7.5, "comment": "linux + linux_generic" },
    "ios":                { "exits":  239, "pct":  2.3 },
    "iot":                { "exits":   62, "pct":  0.6 },
    "network_appliance":  { "exits":    6, "pct":  0.1 },
    "unclassified":       { "exits":   72, "pct":  0.7 }
  }
}