HTTP/2 frames (Akamai)

2:0;4:65535|67043329|0|m,s,a,p

first seen 2026-06-18 18:17 · last seen 2026-10-30 22:53 · JSON

Last 7 days (31 observations)

Distinct clients per day (last 30 days, peak 10/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

SETTINGS{"2": 0, "4": 65535}
WINDOW_UPDATE67043329
PRIORITY frames0
Pseudo-header orderm,s,a,p

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d2212h2_231e334592e8_36bf25f296df Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.188
t13d1114h2_c5d436628c5c_d2ecb6802617124
t13d1212h2_a538d02d76d5_f6eeaf393d2e13
t13d2211h2_231e334592e8_29829a46703f10
t13d2012h2_2b729b4bf6f3_36bf25f296df10
t13d1012h2_01be160bb49b_36bf25f296df8
t13d2013h2_2b729b4bf6f3_e24568c0d440 Match?Exact match in Thumbprint's published controlled catalog captures: winhttp 10.0.20348.1.The fingerprint page shows the full measured match list. More on the catalog.4
t13d1013h2_01be160bb49b_e24568c0d4404
t13d2213h2_231e334592e8_e24568c0d4404

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn04enus_39a3ba4480e8_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2.The fingerprint page shows the full measured match list. More on the catalog.97
ge20nn020000_fb4f949fd323_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.64
ge20nn000000_000000000000_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: rust-hyper 1.11.1, rust-hyper 1.11.0, rust-hyper 1.12.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.24
ge20nn040000_272467e735d1_000000000000_00000000000013
ge20nn040000_200b94e8daef_000000000000_00000000000012
ge20nn040000_a610c1346bea_000000000000_00000000000012
ge20nn040000_4fc62b8ba0b7_000000000000_0000000000009
ge20nn040000_89d3fd0d6813_000000000000_0000000000009
ge20nn040000_421e6bfdbec2_000000000000_0000000000009
ge20nn040000_bdf2d84aab57_000000000000_0000000000009

TCP SYN (p0f)

fingerprintco-occurrences
4:114+14:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0128
4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:0124
4:112+16:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:016
4:113+15:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:012
4:110+18:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:012
4:109+19:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:010
4:111+17:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:010
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:09
4:114+14:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:09
4:110+18:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:06

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-1-3-1-1-4_1440_8186
65320_2-4-8-1-3_1420_10124
65535_2-1-3-1-1-4_1440_821
64240_2-4-8-1-3_1460_711
64240_2-1-3-1-1-4_1460_810
62727_2-4-8-1-3_1460_102

User-Agent

fingerprintco-occurrences
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36180
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.3697
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3650
Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.26100; en-US) PowerShell/7.6.68
Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.20348; en-US) PowerShell/7.6.66

Country

fingerprintco-occurrences
US · United States220
BE · Belgium120
NL · Netherlands21
PL · Poland4

Network (ASN)

fingerprintco-occurrences
AS8075 · Microsoft Corporation218
AS396982 · Google LLC124
AS218785 · TC DATACENTER LIMITED11
AS48090 · TECHOFF SRV LIMITED10
AS14618 · Amazon.com, Inc.2

TLS supported groups

fingerprintco-occurrences
11ec,001d,0017,001e,0018,0019,0100,0101 Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 24.22.1, python-httpx 0.28.1, python-requests 2.34.2, +2 more.The fingerprint page shows the full measured match list. More on the catalog.48
0018,0017 Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.7, powershell 5.1.26100.33648, curl 8.21.0.The fingerprint page shows the full measured match list. More on the catalog.25
001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.11.27, powershell 7.6.8, +1 more.The fingerprint page shows the full measured match list. More on the catalog.3