HTTP/2 frames (Akamai)
1:65536;4:131072;5:16384|12517377|3:0:0:201,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1,13:0:0:241,15:0:11:22|m,p,a,s
first seen 2026-07-05 13:24 · last seen 2026-07-05 17:00 · JSON
Decomposed attributes
| SETTINGS | {"1": 65536, "4": 131072, "5": 16384} |
|---|
| WINDOW_UPDATE | 12517377 |
|---|
| PRIORITY frames | 3:0:0:201,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1,13:0:0:241,15:0:11:22 |
|---|
| Pseudo-header order | m,p,a,s |
|---|
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
TLS ClientHello (JA4)
HTTP request (JA4H)
TCP SYN (p0f)
| fingerprint | co-occurrences |
|---|
4:50+14:0:1460:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:0 | 2 |
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 | 1 |
TCP SYN (JA4T)
User-Agent
Country
| fingerprint | co-occurrences |
|---|
EE · Estonia | 2 |
CN · China | 1 |
Network (ASN)
| fingerprint | co-occurrences |
|---|
AS3249 · Telia Eesti AS | 2 |
AS4134 · CHINANET BACKBONE | 1 |
Cross-transport links
TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).