HTTP/2 frames (Akamai)

1:4096;2:0;4:32768;5:16384|12517377|9:0:0:22|m,p,a,s

first seen 2026-07-29 10:03 · last seen 2026-08-21 06:15 · JSON

Decomposed attributes

SETTINGS{"1": 4096, "2": 0, "4": 32768, "5": 16384}
WINDOW_UPDATE12517377
PRIORITY frames9:0:0:22
Pseudo-header orderm,p,a,s

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1616h2_86a278354501_eeeea65629605
t13d1516h2_8daaf6152771_eeeea65629601

HTTP request (JA4H)

fingerprintco-occurrences
ge20nr09zhcn_bfc092dff6c6_000000000000_0000000000004
ge20nr09rukg_bfc092dff6c6_000000000000_0000000000002

TCP SYN (p0f)

fingerprintco-occurrences
4:49+15:0:1460:mss*44,11:mss,sok,ts,nop,ws:df,id+:04
4:50+14:0:1394:65535,9:mss,sok,ts,nop,ws:df,id+:02

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_114
65535_2-4-8-1-3_1394_92

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Android 14; Mobile; rv:153.0) Gecko/153.0 Firefox/153.03
Mozilla/5.0 (Android 15; Mobile; rv:153.0) Gecko/153.0 Firefox/153.02
Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.01

Country

fingerprintco-occurrences
ID · Indonesia4
TR · Turkey2

Network (ASN)

fingerprintco-occurrences
AS45102 · Alibaba (US) Technology Co., Ltd.4
AS15924 · Vodafone Net Iletisim Hizmetler AS2

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
q13d0315h3_55b375c5d22e_dc5437974b472