The 4187 signatures were useful for us in confirming results of other Heartbleed investigation and analysis. We saw a number of 4187/4 hits on systems running TLS that was not the OpenSSL version and we are investigating whether this code is vulnerable too. What is the exact criteria used for "server returns larger than expected heartbeat response"? thanks, sw