Reverse DNS is pretty lousy for this, truth be told. Perhaps a couple of decades back there was a reasonable chance of reverse lookup bearing some relation to

Reverse DNS is pretty lousy for this, truth be told. Perhaps a couple of decades back there was a reasonable chance of reverse lookup bearing some relation to the host component of the URL that led to the exchange of packets. These days, I'd consider such commonality to be a surprising exception. In particular, don't interpret that 68% figure of bijection to mean the reverse lookup will be meaningful. I'd wager a large number of them are public cloud instances, and a PTR string ending in "compute.amazonaws.com" isn't likely to be a famous bookshop. Hey, consider yourself lucky it wasn't a NXDOMAIN. Note that DNS is not actually normative for HTTP. The standard does not specify how names are resolved to endpoints; it defines no service name or equivalent/alternative record. For years the standards committee has (quite shamefully and negligently in my view) relied on tacitly squatting the address (A/AAAA) record. This architectural wart forces workarounds for consequential misbehaviours both in HTTP (such as aliasing at the domain apex), and in other protocols besides since everyone else has to tiptoe around the entitled gorilla. I suspect the workarounds thus employed further contribute to the fingerprinting options available.