HTTP/2 frames (Akamai)

2:0;4:4194304;5:16384;6:262144;1:65536|1073741824|0|a,m,p,s

first seen 2026-08-07 15:37 · last seen 2026-10-27 08:28 · JSON

Last 7 days (97 observations)

Distinct clients per day (last 30 days, peak 2/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

SETTINGS	`{"1": 65536, "2": 0, "4": 4194304, "5": 16384, "6": 262144}`
WINDOW_UPDATE	`1073741824`
PRIORITY frames	`0`
Pseudo-header order	`a,m,p,s`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1516h2_8daaf6152771_d8a2da3f94cd` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 149.0.7827.102, chrome 149.0.7827.102, chrome 149.0.7827.156, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	1483
`t13d2014h2_a09f3c656075_14788d8d241b`	3

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nr050000_857b5fa3405d_000000000000_000000000000`	204
`ge20nn050000_857b5fa3405d_000000000000_000000000000`	183
`ge20nr050000_277e78b0d503_000000000000_000000000000`	143
`ge20nr050000_bb384e635ab6_000000000000_000000000000`	133
`ge20nr050000_7e80a5f53adf_000000000000_000000000000`	127
`ge20nn050000_7e80a5f53adf_000000000000_000000000000`	58
`ge20nn050000_277e78b0d503_000000000000_000000000000`	51
`ge20nn050000_bb384e635ab6_000000000000_000000000000`	45
`ge20nn030000_bf75ddd0bb29_000000000000_000000000000`	12
`ge20nn030000_80b089f68b8e_000000000000_000000000000`	9

TCP SYN (p0f)

fingerprint	co-occurrences
`4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:0`	1300
`4:58+6:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:0`	136
`4:51+13:0:1380:65535,13:mss,sok,ts,nop,ws:df,id+:0`	47
`6:45+19:0:1432:mss*45,10:mss,sok,ts,nop,ws:flow:0`	1
`4:51+13:0:1400:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	1
`6:42+22:0:1432:mss*45,10:mss,sok,ts,nop,ws:flow:0`	1

TCP SYN (JA4T)

fingerprint	co-occurrences
`65320_2-4-8-1-3_1420_10`	1300
`65320_2-4-8-1-3_1420_7`	136
`65535_2-4-8-1-3_1380_13`	47
`64800_2-4-8-1-3_1432_10`	2
`64240_2-4-8-1-3_1400_10`	1

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36`	242
`Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)`	94
`Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36`	67
`Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)`	46
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36`	45
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36`	38
`Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)`	37
`Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)`	37
`Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)`	36
`Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)`	35

Country

fingerprint	co-occurrences
`TW` · Taiwan	696
`US` · United States	392
`SG` · Singapore	251
`BE` · Belgium	97
`FR` · France	47
`TR` · Turkey	3

Network (ASN)

fingerprint	co-occurrences
`AS396982` · Google LLC	1436
`AS13335` · Cloudflare, Inc.	47
`AS12735` · TurkNet Iletisim Hizmetleri A.S.	3

TLS supported groups

fingerprint	co-occurrences
`0a0a,11ec,001d,0017,0018` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 155.0.8059.40, chrome 156.0.8078.73, chromium 156.0.8078.47, +8 more.The fingerprint page shows the full measured match list. More on the catalog.	864