HTTP/2 frames (Akamai)
1:65536;3:1000;4:6291456|15663105|1:1:0:256|m,a,s,p
first seen 2026-06-11 21:04 · last seen 2026-08-29 19:44 · JSON
Distinct clients per day (last 30 days, peak 7/day)
Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.
Decomposed attributes
SETTINGS {"1": 65536, "3": 1000, "4": 6291456}WINDOW_UPDATE 15663105PRIORITY frames 1:1:0:256Pseudo-header order m,a,s,p
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
TLS ClientHello (JA4)
HTTP request (JA4H)
TCP SYN (p0f)
fingerprint co-occurrences
4:42+22:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:012 4:43+21:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:06 4:45+19:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02 4:246+9:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:02 4:240+15:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:01 4:110+18:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01 4:244+11:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:01 4:44+20:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:01 4:241+14:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:01 4:238+17:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:01
TCP SYN (JA4T)
User-Agent
fingerprint co-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.08 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/61.0.3163.100 Chrome/61.0.3163.100 Safari/537.36 PingdomPageSpeed/1.0 (pingbot/2.0; +http://www.pingdom.com/)6 Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.365 Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.362 Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; MI 8 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Mobile Safari/537.362 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 PTST/18.101 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.361 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.361 Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.361 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.791
Country
fingerprint co-occurrences
CN· China 12 DE· Germany 7 US· United States 3 CA· Canada 2 GB· United Kingdom 2 FR· France 1 SK· Slovakia 1
Network (ASN)