Network (ASN)

AS23974

first seen 2026-08-20 22:37 · last seen 2026-08-31 03:19 · JSON

Decomposed attributes

Network name	`Ministry of education`
Domain	`moe.go.th`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13i170900_5b57614c22b0_78e6aca7449b`	2
`t13d2913h1_723694b0fccc_5671b5df5029`	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn070000_d0d63ed74832_000000000000_000000000000`	1
`ge11nn050000_c71bbc472f37_000000000000_000000000000`	1
`ge11nn11thth_835281d8e5d9_000000000000_000000000000`	1

TCP SYN (p0f)

fingerprint	co-occurrences
`4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	2
`4:111+17:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0`	1

TCP SYN (JA4T)

fingerprint	co-occurrences
`64240_2-4-8-1-3_1460_7`	2
`65535_2-1-3-1-1-4_1460_8`	1

User-Agent

fingerprint	co-occurrences
`libredtail-http`	2
`Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1`	1

Country

fingerprint	co-occurrences
`TH` · Thailand	3