TCP SYN (JA4T)

64240_2-4-8-1-3_1418_7

first seen 2026-07-08 00:49 · last seen 2026-09-03 20:45 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

TCP window	`64240`
Option kinds	`2-4-8-1-3`
MSS	`1418`
Window scale	`7`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d131100_f57a46bbacb6_ab7e3b40a677` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.5, go-net/http 1.26.4.The fingerprint page shows the full measured match list. More on the catalog.	16
`t13d3113h2_e8f1e7e78f70_ce5650b735ce`	1
`t13d4412h1_fd39b124ee10_58ed7828516f`	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn050000_3658ef221638_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.21.3, wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog.	16
`ge20nn020000_5594a17e7e7e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.18.0, +9 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`ge11nn050000_b223a0ebb0b5_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.	1

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`3:100;4:33554432;2:0\|33488897\|0\|m,p,s,a` Match?Exact match in Thumbprint's published controlled catalog captures: php-curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.	1

TCP SYN (p0f)

fingerprint	co-occurrences
`4:43+21:0:1418:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	15
`4:47+17:0:1418:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	1
`4:48+16:0:1418:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	1
`4:41+23:0:1418:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	1

User-Agent

fingerprint	co-occurrences
`curl/8.6.0`	16
`curl/7.81.0`	1
`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.116 Safari/537.36`	1

Country

fingerprint	co-occurrences
`NL` · Netherlands	16
`US` · United States	1
`CO` · Colombia	1

Network (ASN)

fingerprint	co-occurrences
`AS8075` · Microsoft Corporation	17
`AS272869` · INTERCOMM DE NARIÑO SAS	1