TCP SYN (JA4T)

29200_2-4-8-1-3_1460_7

first seen 2026-06-29 23:09 · last seen 2026-09-16 14:03 · JSON

Last 7 days (13 observations)

Distinct clients per day (last 30 days, peak 6/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

TCP window29200
Option kinds2-4-8-1-3
MSS1460
Window scale7

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d191000_9dc949149365_e7c28522265147
t12d990700_a40d17a72bcb_4446390ac22443
t12d490600_730fb1b0ac6a_a1e93568279525
t12d130600_2d7513195f68_e51b7354d87f19
t12d700700_b8b0f76b4bb5_4446390ac22411
t13i1909h2_9dc949149365_97f8aa674fd911
t13i170900_5b57614c22b0_78e6aca7449b8
t13d5911h1_a33745022dd6_1f22a2ca17c4 Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 23.11.1.The fingerprint page shows the full measured match list. More on the catalog.7
t13d131100_f57a46bbacb6_ab7e3b40a677 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.5, go-net/http 1.26.4.The fingerprint page shows the full measured match list. More on the catalog.5
t13d1516h2_8daaf6152771_d8a2da3f94cd Match?Exact match in Thumbprint's published controlled catalog captures: chromium 149.0.7827.102, chrome 149.0.7827.102, chrome 149.0.7827.156, +25 more.The fingerprint page shows the full measured match list. More on the catalog.4

HTTP request (JA4H)

fingerprintco-occurrences
ge11nr040000_e1d2031bdfea_000000000000_00000000000064
ge11nn040000_08e7224bf8c7_000000000000_00000000000043
ge11nn07zhcn_ad6bb88d6320_000000000000_00000000000026
ge11nn050000_0b4164a3b800_000000000000_00000000000011
ge20nr030000_80b089f68b8e_000000000000_0000000000009
ge11nn07*000_2f91038604b7_000000000000_0000000000007
ge11nn040000_17807bc4167d_000000000000_0000000000006
ge11nn040000_e1d2031bdfea_000000000000_0000000000006
ge11nr030000_cd680697de12_000000000000_0000000000004
ge11nn06en00_c8b5fb2f281e_000000000000_0000000000003

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:4194304;5:16384;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.8, go-net/http 1.26.7, +6 more.The fingerprint page shows the full measured match list. More on the catalog.12
1:65536;2:0;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +43 more.The fingerprint page shows the full measured match list. More on the catalog.5
3:100;4:33554432;2:0|33488897|0|m,p,s,a Match?Exact match in Thumbprint's published controlled catalog captures: php-curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.3
2:0;3:100;4:2097152;9:1|10420225|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.5, safari 26.4, +2 more.The fingerprint page shows the full measured match list. More on the catalog.3
1:65536;2:0;4:6291456;6:262144|15663105|1:1:0:220|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 149.0.7827.102, +59 more.The fingerprint page shows the full measured match list. More on the catalog.2
1:65536;2:0;3:1000;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p2
1:65536;3:1000;4:6291456|15663105|1:1:0:256|m,a,s,p1
3:100;4:10485760;2:0|1048510465|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0.The fingerprint page shows the full measured match list. More on the catalog.1
4:4194304;3:100|10485760|1:0:0:255|m,s,p,a1

TCP SYN (p0f)

fingerprintco-occurrences
4:43+21:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:044
4:45+19:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:035
4:46+18:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:028
4:47+17:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:011
4:55+9:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:011
4:54+10:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:011
4:51+13:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:011
4:53+11:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:011
4:52+12:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:09
4:56+8:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:07

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE47
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.2623.112 Safari/537.3643
Mozilla/5.0 (Linux; Android 11; M2004J15SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.3619
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/601.1.2713
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:61.0) Gecko/20100101 Firefox/72.011
python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_6410
libredtail-http8
Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)8
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.367
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.363

Country

fingerprintco-occurrences
CN · China122
US · United States48
NL · Netherlands18
LT · Lithuania7
RO · Romania6
LY · Libya4
KR · South Korea3
TH · Thailand3
FR · France2
RU · Russia2

Network (ASN)

fingerprintco-occurrences
AS58461 · CT HangZhou IDC101
AS45102 · Alibaba (US) Technology Co., Ltd.19
AS14061 · DigitalOcean, LLC14
AS4811 · China Telecom (Group)12
AS49870 · Alsycon B.V.11
AS21412 · UAB Cgates7
AS47890 · UNMANAGED LTD6
AS4134 · CHINANET BACKBONE5
AS136907 · HUAWEI CLOUDS4
AS37284 · Aljeel Aljadeed For Technology4