TCP SYN (JA4T)

64240_2-1-3-1-1-4_1460_8

first seen 2026-06-29 23:12 · last seen 2026-09-16 11:43 · JSON

Last 7 days (84 observations)

Distinct clients per day (last 30 days, peak 114/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

TCP window	`64240`
Option kinds	`2-1-3-1-1-4`
MSS	`1460`
Window scale	`8`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1516h2_8daaf6152771_d8a2da3f94cd` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 149.0.7827.102, chrome 149.0.7827.102, chrome 149.0.7827.156, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	431
`t13d2913h1_723694b0fccc_5671b5df5029`	339
`t13d1812h1_85036bcba153_b26ce05bbdd6`	106
`t13d1617h2_86a278354501_3cbfd9057e0d` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 152.0.3, +10 more.The fingerprint page shows the full measured match list. More on the catalog.	58
`t13d181000_e8a523a41297_78e6aca7449b`	47
`t13d1516h2_8daaf6152771_806a8c22fdea` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chrome 151.0.7922.137, chromium 151.0.7922.34, +24 more.The fingerprint page shows the full measured match list. More on the catalog.	43
`t13d1515h1_8daaf6152771_de4a06bb82e3`	21
`t13d1515h1_8daaf6152771_0a20fe35d3a5`	20
`t12d860600_e18388e7f3a3_a1e935682795`	18
`t13d131100_f57a46bbacb6_ab7e3b40a677` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.5, go-net/http 1.26.4.The fingerprint page shows the full measured match list. More on the catalog.	16

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn050000_b223a0ebb0b5_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.	64
`ge11nn13enus_9db22d02e17a_000000000000_000000000000`	29
`ge20nr16enus_94fdc06e0694_000000000000_000000000000`	27
`ge20nr16kokr_94fdc06e0694_000000000000_000000000000`	26
`ge20nr16bgbg_94fdc06e0694_000000000000_000000000000`	24
`ge20nr16svse_94fdc06e0694_000000000000_000000000000`	24
`ge20nr12enus_54b4638ab28b_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chrome 151.0.7922.137, edge 151.0.4129.93, +36 more.The fingerprint page shows the full measured match list. More on the catalog.	23
`ge20nr16dadk_94fdc06e0694_000000000000_000000000000`	22
`ge20nr16engb_94fdc06e0694_000000000000_000000000000`	20
`ge20nn13enus_0c2c1d640f3e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 151.0.7922.137, chrome 151.0.7922.170, chrome 151.0.7922.108, +23 more.The fingerprint page shows the full measured match list. More on the catalog.	20

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +43 more.The fingerprint page shows the full measured match list. More on the catalog.	433
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:42\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	60
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 149.0.7827.102, +59 more.The fingerprint page shows the full measured match list. More on the catalog.	51
`2:0;4:4194304;5:16384;6:10485760\|1073741824\|0\|a,m,p,s` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.8, go-net/http 1.26.7, +6 more.The fingerprint page shows the full measured match list. More on the catalog.	14
`3:100;4:10485760;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0.The fingerprint page shows the full measured match list. More on the catalog.	9
`1:65536;2:0;4:6291456;6:262144\|15663105\|3:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 151.0.7922.34, chromium 147.0.7727.15, chromium 145.0.7632.6, +21 more.The fingerprint page shows the full measured match list. More on the catalog.	6
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`2:0;3:100;4:2097152;9:1\|10420225\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.5, safari 26.4, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	3
`2:0;4:65535\|67043329\|0\|m,s,a,p`	3
`1:4096;2:0;4:65535;5:16384;8:0;3:100;6:65536\|00\|0\|m,s,p,a`	2

TCP SYN (p0f)

fingerprint	co-occurrences
`4:112+16:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	116
`4:120+8:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	103
`4:110+18:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	102
`4:111+17:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	90
`4:116+12:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	81
`4:109+19:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	79
`4:116+12:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	71
`4:114+14:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	70
`4:113+15:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	69
`4:117+11:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0`	67

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203`	48
`Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1`	35
`Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1`	29
`Mozilla/5.0 (Linux; Android 13; Redmi Note 12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36`	29
`Mozilla/5.0 (Android 14; Mobile; rv:153.0) Gecko/153.0 Firefox/153.0`	27
`Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/153.0 Mobile/15E148 Safari/604.1`	27
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36`	24
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`	23
`Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1`	22
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36`	22

Country

fingerprint	co-occurrences
`US` · United States	150
`NL` · Netherlands	138
`DE` · Germany	134
`FR` · France	74
`KR` · South Korea	66
`GB` · United Kingdom	63
`BG` · Bulgaria	59
`CA` · Canada	56
`DK` · Denmark	51
`RU` · Russia	40

Network (ASN)

fingerprint	co-occurrences
`AS209946` · ALINDA LLC	75
`AS213388` · IIC RAIL LIMITED	59
`AS4766` · Korea Telecom	46
`AS14593` · Space Exploration Technologies Corporation	45
`AS197170` · TechTies Inc.	43
`AS3292` · TDC Holding A/S	42
`AS5466` · Eircom Limited	37
`AS5089` · Virgin Media Limited	34
`AS8866` · Vivacom Bulgaria EAD	34
`AS7922` · Comcast Cable Communications, LLC	32

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprint	linked observations
`q13d0311h3_55b375c5d22e_653d80c3fe9d`	39
`q13d0312h3_55b375c5d22e_178839b6cec1`	10

fingerprint	co-occurrences
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +43 more.The fingerprint page shows the full measured match list. More on the catalog.	433
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:42\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	60
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 149.0.7827.102, +59 more.The fingerprint page shows the full measured match list. More on the catalog.	51
`2:0;4:4194304;5:16384;6:10485760\|1073741824\|0\|a,m,p,s` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.8, go-net/http 1.26.7, +6 more.The fingerprint page shows the full measured match list. More on the catalog.	14
`3:100;4:10485760;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0.The fingerprint page shows the full measured match list. More on the catalog.	9
`1:65536;2:0;4:6291456;6:262144\|15663105\|3:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 151.0.7922.34, chromium 147.0.7727.15, chromium 145.0.7632.6, +21 more.The fingerprint page shows the full measured match list. More on the catalog.	6
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`2:0;3:100;4:2097152;9:1\|10420225\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.5, safari 26.4, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	3
`2:0;4:65535\|67043329\|0\|m,s,a,p`	3
`1:4096;2:0;4:65535;5:16384;8:0;3:100;6:65536\|00\|0\|m,s,p,a`	2