HTTP/2 frames (Akamai)

3:100;4:65536;2:0|1048510465|0|m,s,a,p

first seen 2026-06-10 23:54 · last seen 2026-09-16 17:27 · JSON

Last 7 days (50 observations)

Distinct clients per day (last 30 days, peak 159/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

SETTINGS{"2": 0, "3": 100, "4": 65536}
WINDOW_UPDATE1048510465
PRIORITY frames0
Pseudo-header orderm,s,a,p

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d3013h2_1d37bd780c83_8537cf56674e749
t13d4113h2_8ae0994cad11_86f67be995ff193
t13d3112h2_e8f1e7e78f70_b26ce05bbdd6 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.5.0, php-curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.188
t13d1711h2_5b57614c22b0_5894756fee65131
t13d3112h2_e8f1e7e78f70_8d633dac7124127
t13d3012h2_1d37bd780c83_882d495ac381 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.21.0, curl 8.22.0, curl 8.20.0, +6 more.The fingerprint page shows the full measured match list. More on the catalog.19
t13d1807h2_796efca44d18_7395dae3b2f312
t13d3513h2_bfa337485184_8d7351bd871b Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.18.0.The fingerprint page shows the full measured match list. More on the catalog.8
t13i4112h2_8ae0994cad11_86f67be995ff6
t13d2713h2_c42a7efa14d1_8d7351bd871b5

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.18.0, +9 more.The fingerprint page shows the full measured match list. More on the catalog.857
ge20nn060000_2a1d139103bd_000000000000_000000000000149
ge20nn040000_b221e026a664_000000000000_00000000000092
ge20nn030000_042112399351_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0.The fingerprint page shows the full measured match list. More on the catalog.81
ge20nn030000_bf75ddd0bb29_000000000000_00000000000057
ge20nn070000_475aaf807767_000000000000_00000000000039
he20nn030000_bf75ddd0bb29_000000000000_00000000000036
he20nn040000_8e83c27df1d3_000000000000_00000000000034
ge20nn050000_95d177640a65_000000000000_00000000000024
he20nn020000_5594a17e7e7e_000000000000_00000000000011

TCP SYN (p0f)

fingerprintco-occurrences
4:57+7:0:1420:mss*30,7:mss,sok,ts,nop,ws:df,id+:0127
4:55+9:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:096
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:055
4:46+18:0:1460:65535,14:mss,sok,ts,nop,ws:df,id+,ecn:052
4:48+16:0:1460:65535,14:mss,sok,ts,nop,ws:df,id+,ecn:052
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:051
4:47+17:0:1460:65535,14:mss,sok,ts,nop,ws:df,id+,ecn:046
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:046
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:042
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:040

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_1460_6296
65535_2-4-8-1-3_1460_14148
42600_2-4-8-1-3_1420_7125
64240_2-4-8-1-3_1460_10118
42300_2-4-8-1-3-34-1-1_1410_8101
65535_2-4-8-1-3_1460_477
64240_2-4-8-1-3_1460_765
65535_2-4-8-1-3_1460_245
65535_2-4-8-1-3_1460_833
65535_2-4-8-1-3_1356_625

User-Agent

fingerprintco-occurrences
curl/8.14.1676
Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)188
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36182
Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)122
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.087
curl/8.21.032
curl/8.20.028
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.3628
curl/8.18.020
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Shap-User/0.1.016

Country

fingerprintco-occurrences
US · United States849
AU · Australia201
RU · Russia92
CA · Canada66
GB · United Kingdom46
FR · France42
TR · Turkey33
DE · Germany24
IN · India17
KZ · Kazakhstan12

Network (ASN)

fingerprintco-occurrences
AS38195 · Superloop199
AS16276 · OVH SAS174
AS7922 · Comcast Cable Communications, LLC174
AS396982 · Google LLC132
AS20001 · Charter Communications Inc106
AS13238 · YANDEX LLC90
AS7018 · AT&T Enterprises, LLC57
AS20115 · Charter Communications LLC47
AS5650 · Verizon Business43
AS21928 · T-Mobile USA, Inc.38

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
q13d0413h3_9caa18292e23_23fce1e67d9813
q13d0307h3_55b375c5d22e_1cecd519fee81