HTTP request (JA4H)

ge11nn07zhcn_ad6bb88d6320_000000000000_000000000000

first seen 2026-07-25 19:19 · last seen 2026-10-31 08:51 · JSON

Last 7 days (22 observations)

Distinct clients per day (last 30 days, peak 7/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Methodge
HTTP version11
Cookieno
Refererno
Header count7
Accept-Languagezhcn
Header orderHost, User-Agent, Accept-Encoding, Accept, Connection, Cache-Control, Accept-Language
Header-order hashad6bb88d6320
Cookie-name hash000000000000
Cookie-value hash000000000000
JA4H_rge11nn07zhcn_Host,User-Agent,Accept-Encoding,Accept,Connection,Cache-Control,Accept-Language__

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t12d490600_730fb1b0ac6a_a1e93568279570
t13d4311h1_c7886603b240_7379471da27232
t12d4906h1_730fb1b0ac6a_22a92d800fe413

TCP SYN (p0f)

fingerprintco-occurrences
4:41+23:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:031
4:41+23:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:026
4:34+30:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:021
4:45+19:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:011
4:44+20:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:07
4:35+29:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:07
4:48+16:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:06
4:43+21:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:03
4:37+27:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:02
4:39+25:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
29200_2-4-8-1-3_1460_783
64240_2-4-8-1-3_1460_732

User-Agent

fingerprintco-occurrences
Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)42
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/601.1.2739
Mozilla/5.0 (Linux; U; Android 5.1.1; zh-CN; vivo X7L Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/11.9.4.974 UWS/2.14.0.5 Mobile Safari/537.36 AliApp(TB/7.8.7) UCBS/2.11.1.1 TTID/600129@taobao_android_7.8.7 WindVane/8.3.0 1080X19201
Mozilla/5.0 (Linux; Android 7.1.2; Redmi Note 5A Build/N2G47H; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/043910 Mobile Safari/537.36 V1_AND_SQ_7.5.5_806_YYB_D QQ/7.5.5.3460 NetType/4G WebP/0.3.0 Pixel/7201
Mozilla/5.0 (Linux; Android 7.0; FRD-AL00 Build/HUAWEIFRD-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.116 Mobile Safari/537.36 MicroMessenger/6.6.6.1300(0x26060637) NetType/4G Language/zh_CN1
Mozilla/5.0 (Linux; U; Android 7.1.2; zh-CN; vivo X9Plus Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/11.8.8.968 Mobile Safari/537.361
Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.61
Mozilla/5.0 (ZX-81; U; CP/M86; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.11
Mozilla/5.0 (Linux; Android 8.0; LON-AL00 Build/HUAWEILON-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/48.0.2564.116 Mobile Safari/537.36 T7/10.10 baiduboxapp/10.10.0.12 (Baidu; P1 8.0.0)1
Mozilla/5.0 (Linux; Android 8.1; MI 8 SE Build/OPM1.171019.019; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044113 Mobile Safari/537.36 V1_AND_SQ_7.7.0_882_YYB_D QQ/7.7.0.3640 NetType/WIFI WebP/0.3.0 Pixel/10801

Country

fingerprintco-occurrences
CN · China115

Network (ASN)

fingerprintco-occurrences
AS4837 · CHINA UNICOM China169 Backbone35
AS4811 · China Telecom (Group)33
AS58461 · CT HangZhou IDC30
AS4134 · CHINANET BACKBONE11
AS56046 · China Mobile communications corporation6

TLS supported groups

fingerprintco-occurrences
0017,0019,0018,001631
001d,0017,001e,0019,00187