HTTP/2 frames (Akamai)

2:0;6:262144|10485760|0|m,a,s,p

first seen 2026-07-02 13:02 · last seen 2026-10-28 06:15 · JSON

Last 7 days (22 observations)

Distinct clients per day (last 30 days, peak 2/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

SETTINGS{"2": 0, "6": 262144}
WINDOW_UPDATE10485760
PRIORITY frames0
Pseudo-header orderm,a,s,p

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1611h2_1711a4c0508c_6d021c4c45cd35

HTTP request (JA4H)

fingerprintco-occurrences
ge20nr14enus_ff5cb1f26f52_000000000000_0000000000006
ge20nr14enus_a725ed712cd5_000000000000_0000000000006
ge20nn15zhcn_aa31bfec5873_000000000000_0000000000005
ge20nr14enus_8bdf938ab49f_000000000000_0000000000004
ge20nr13enus_9093f0c7a28b_000000000000_0000000000003
ge20nr12enus_f09392c0366d_000000000000_0000000000002
ge20nn15zhcn_accd953c130e_000000000000_0000000000002
ge20nr13enus_fcb564d9f630_000000000000_0000000000001
ge20nn16zhcn_aa6aa512ad54_000000000000_0000000000001
ge20nn17zhcn_47602fdc1579_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:44+20:0:9174:65535,10:mss,sok,ts,nop,ws:df,id+:012
4:46+18:0:9174:65535,10:mss,sok,ts,nop,ws:df,id+:09
6:54+10:0:1440:mss*45,12:mss,nop,nop,sok,nop,ws:flow:06
4:121+7:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:03
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
4:116+12:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:113+15:0:1452:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:117+11:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_9174_1021
64800_2-1-1-4-1-3_1440_126
65535_2-1-3-1-1-4_1460_85
64240_2-4-8-1-3_1460_72
65535_2-1-3-1-1-4_1452_81

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36 Edg/156.0.0.021
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.367
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.03
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.361

Country

fingerprintco-occurrences
HK · Hong Kong SAR China29
AU · Australia3
SG · Singapore1
CN · China1
SK · Slovakia1

Network (ASN)

fingerprintco-occurrences
AS41378 · Kirino LLC21
AS48266 · Catixs Ltd6
AS4764 · Aussie Fibre Pty Ltd3
AS38136 · Akari Networks2
AS9808 · China Mobile Communications Group Co., Ltd.1
AS6830 · Liberty Global Europe Holding B.V.1
AS4637 · Telstra Global1

TLS supported groups

fingerprintco-occurrences
11ec,001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: chrome 155.0.8059.40, chrome 156.0.8078.73, chromium 156.0.8078.47, +8 more.The fingerprint page shows the full measured match list. More on the catalog.23
001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.11.27, powershell 7.6.8, +1 more.The fingerprint page shows the full measured match list. More on the catalog.1