HTTP/2 frames (Akamai)

1:65536;2:0;3:1000;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p

first seen 2026-06-11 06:02 · last seen 2026-10-30 22:11 · JSON

Last 7 days (64 observations)

Distinct clients per day (last 30 days, peak 25/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

SETTINGS	`{"1": 65536, "2": 0, "3": 1000, "4": 6291456, "6": 262144}`
WINDOW_UPDATE	`15663105`
PRIORITY frames	`1:1:0:256`
Pseudo-header order	`m,a,s,p`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1516h2_8daaf6152771_e5627efa2ab1`	247
`t13d1313h2_f57a46bbacb6_9249cab70c77`	163
`t13d1516h2_8daaf6152771_02713d6af862` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 134.0.6998.35, chromium 133.0.6943.16.The fingerprint page shows the full measured match list. More on the catalog.	121
`t13d1516h2_8daaf6152771_d8a2da3f94cd` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 149.0.7827.102, chrome 149.0.7827.102, chrome 149.0.7827.156, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	13
`t13d1515h2_8daaf6152771_de4a06bb82e3`	6
`t13d1517h2_8daaf6152771_520bb30278ac`	4
`t13i1515h2_8daaf6152771_02713d6af862`	3
`t13d1517h2_8daaf6152771_0bf6ec06e199`	3

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nn12enus_60f823d07c94_000000000000_000000000000`	195
`ge20nn020000_fb4f949fd323_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.	91
`ge20nr020000_fb4f949fd323_000000000000_000000000000`	72
`ge20nn05en00_fac3da1ed2d2_000000000000_000000000000`	25
`ge20nr05en00_e6370f8e4d7a_000000000000_000000000000`	23
`ge20nn14en00_c2507efc711e_000000000000_000000000000`	22
`ge20nr14en00_c2507efc711e_000000000000_000000000000`	19
`ge20nn110000_f553327a6567_000000000000_000000000000`	19
`ge20nr14enus_c2507efc711e_000000000000_000000000000`	12
`ge20nn13enus_0c2c1d640f3e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 151.0.7922.137, chrome 151.0.7922.170, chrome 151.0.7922.108, +36 more.The fingerprint page shows the full measured match list. More on the catalog.	9

TCP SYN (p0f)

fingerprint	co-occurrences
`4:50+14:0:1460:mss*29,10:mss,sok,ts,nop,ws:df,id+:0`	43
`4:42+22:0:1460:mss*29,10:mss,sok,ts,nop,ws:df,id+:0`	28
`4:43+21:0:1460:mss*29,10:mss,sok,ts,nop,ws:df,id+:0`	27
`6:51+13:0:1360:mss*6,10:mss,sok,ts,nop,ws:ecn,flow:0`	22
`4:47+17:0:1460:65535,3:mss,sok,ts,nop,ws:df,id+:0`	21
`4:50+14:0:1460:35844,10:mss,sok,ts,nop,ws:df,id+:0`	14
`4:50+14:0:1460:mss*5,10:mss,sok,ts,nop,ws:df,id+,ecn:0`	11
`6:49+15:0:1360:mss*6,10:mss,sok,ts,nop,ws:ecn,flow:0`	11
`4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	10
`6:47+17:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0`	9

TCP SYN (JA4T)

fingerprint	co-occurrences
`42340_2-4-8-1-3_1460_10`	111
`64240_2-4-8-1-3_1460_7`	42
`8160_2-4-8-1-3_1360_10`	31
`64240_2-4-1-1-1-1-1-1-1-1-1-1-1-3_1398_7`	26
`7300_2-4-8-1-3_1460_10`	23
`35844_2-4-8-1-3_1460_10`	23
`65535_2-4-8-1-3_1460_3`	21
`65535_2-4-8-1-3_1460_6`	20
`64800_2-4-8-1-3_1440_7`	19
`64240_2-4-8-1-3_1452_7`	17

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/7.0 Mobile Safari/537.36 (compatible; Bytespider; https://bytedance.sg.larkoffice.com/docx/K5bxdypulop3IIxrJb0lOjLVgFe)`	124
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36`	81
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36`	59
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`	45
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36`	32
`Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36`	28
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36`	17
`Mozilla/5.0 (Linux; Android 11; Redmi Note 8 Pro Build/RP1A.200720.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/89.0.4389.72 MQQBrowser/6.2 TBS/045913 Mobile Safari/537.36 V1_AND_SQ_8.8.68_2538_YYB_D A_8086800 QQ/8.8.68.7265 NetType/WIFI WebP/0.3.0 Pixel/1080 StatusBarHeight/76 SimpleUISwitch/1 QQTheme/2971 InMagicWin/0 StudyMode/0 CurrentMode/1 CurrentFontScale/1.0 GlobalDensityScale/0.9818182 AppId/537112567 Edg/98.0.4758.102`	17
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36`	11
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36`	11

Country

fingerprint	co-occurrences
`SG` · Singapore	142
`US` · United States	81
`CN` · China	78
`NL` · Netherlands	37
`CA` · Canada	29
`BR` · Brazil	17
`GB` · United Kingdom	16
`SE` · Sweden	12
`FR` · France	12
`TR` · Turkey	12

Network (ASN)

fingerprint	co-occurrences
`AS16509` · Amazon.com, Inc.	127
`AS45102` · Alibaba (US) Technology Co., Ltd.	38
`AS4134` · CHINANET BACKBONE	33
`AS197170` · TechTies Inc.	28
`AS60068` · Datacamp Limited	25
`AS45090` · Shenzhen Tencent Computer Systems Company Limited	12
`AS63018` · Dedicated.com	12
`AS24940` · Hetzner Online GmbH	10
`AS6079` · RCN	10
`AS9808` · China Mobile Communications Group Co., Ltd.	9

TLS supported groups

fingerprint	co-occurrences
`0a0a,001d,0017,0018`	124
`6399,001d,0017,0018,0019`	43