# A Novel TLS-Based Fingerprinting Approach That Combines Feature Expansion and Similarity Mapping
## 3 Methodology
### Tooling  
The initial phase required domain name resolution to IP addresses across large datasets. MassDNS [26] was selected for its effectiveness in large-scale scanning scenarios. As a stub resolver, MassDNS enables parallel processing of thousands of queries per second while maintaining accuracy. Despite this accuracy, the relationship between domains and IP addresses is not static or permanent. Domain name resolution, via the Domain Name System (DNS), only provides a mapping at a specific time, and subsequent scans may resolve to different IP addresses. This limitation can introduce a degree of variability to the fingerprinting process, as subsequent scans can return different TLS or HTTP header patterns. To address this, our methodology focused on snapshots at a specific time within  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Dataset** & **Location** & **Category** \\ \hline Tranco IJNY4 [18] & [[https://tranco-list.eu](https://tranco-list.eu)]([https://tranco-list.eu](https://tranco-list.eu)) & Good \\  & access on 2 March 2025 & \\ UrlHaus [21] & [[https://urlhaus.abuse.ch](https://urlhaus.abuse.ch)]([https://urlhaus.abuse.ch](https://urlhaus.abuse.ch)) & \\  & access on 2 March 2025 & \\ Hunt.io [22] & [[https://hunt.io](https://hunt.io)]([https://hunt.io](https://hunt.io)) & Bad \\  & access on 2 March 2025 & \\  & [[https://hole.cert.pl](https://hole.cert.pl)]([https://hole.cert.pl](https://hole.cert.pl)) & \\  & access on 2 March 2025 & \\ OpenPhish [24] & [[https://openphish.com](https://openphish.com)]([https://openphish.com](https://openphish.com)) & \\  & access on 2 March 2025 & \\ Shreshtait [25] & [[https://shreshtait.com](https://shreshtait.com)]([https://shreshtait.com](https://shreshtait.com)) & \\  & access on 2 March 2025 & Unknown \\ \hline \hline \end{tabular}
\end{table}
Table 2: Table of all datasets used for active scanning.  
the 30-day sliding window, setting a temporal boundary on scans. This approach provided a valid representation of the domains' configuration at any given moment, which was sufficient for detecting patterns in malicious infrastructure.  
For TLS fingerprint generation, the ActiveTLS stack fingerprinting tool [7] was chosen over the more widely recognised JARM process. This was based on two requirements: (1) a transparent output format that would enable further analysis and modification, (2) support for Encrypted ClientHello (ECH) and an increased TLS feature set, as seen in Table 1. While JARM is widely adopted for TLS fingerprinting, its hash-based output format limits feature-level analysis without direct code modification. In contrast, ActiveTLS provides detailed metadata for each TLS feature, enabling the subsequent fine-grained similarity mapping required for the presented methodology. The tool's built-in ten ClientHellos were used, to enable direct comparison to previous research and datasets' outputs. To load balance, domain scanning was randomized across the ten connections. TLS extended output was also enabled, to capture the complete feature set.  
ActiveTLS stack provides HTTP header capture functionality by using the existing TLS connection. However, its implementation presents two limitations: header ordering and correlation challenges when mapping the resultant header data to domains. Given that header sequence is a key element of fingerprinting techniques [16; 17], the built-in HTTP mechanism was deemed unsuitable. To address these limitations, our methodology implemented a separate post-processing phase that established a dedicated TLS connection for each domain that executed a HEAD request, ensuring deterministic header collection.