TCP SYN (JA4T)

64240_2-4-8-1-3_1440_10

first seen 2026-07-01 00:59 · last seen 2026-09-14 22:55 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog →

firefox 155.0 · Ubuntu 24.04 · via geckodriver · ci — 1 session, last 2026-09-14 22:55 controlled
chrome 152.0.7977.82 · Ubuntu 24.04 · via chromedriver · ci — 1 session, last 2026-09-14 22:55 controlled
firefox 154.0.1 · Ubuntu 24.04 · via geckodriver · ci — 1 session, last 2026-09-08 01:08 controlled
wget 1.21.4 · Ubuntu 24.04 · ci — 12 sessions, last 2026-09-07 22:29 controlled
curl 8.5.0 · Ubuntu 24.04 · ci — 12 sessions, last 2026-09-07 22:29 controlled
chrome 152.0.7977.64 · Ubuntu 24.04 · via chromedriver · ci — 1 session, last 2026-09-07 22:27 controlled
firefox 154.0 · Ubuntu 24.04 · via geckodriver · ci — 2 sessions, last 2026-09-01 00:58 controlled
chrome 151.0.7922.173 · Ubuntu 24.04 · via chromedriver · ci — 2 sessions, last 2026-09-01 00:57 controlled
firefox 153.0.4 · Ubuntu 24.04 · via geckodriver · ci — 4 sessions, last 2026-08-26 06:54 controlled
chrome 151.0.7922.137 · Ubuntu 24.04 · via chromedriver · ci — 4 sessions, last 2026-08-26 06:54 controlled

TCP SYN signatures from container or CI runners reflect the capture environment's kernel and network path, not the named client — the layers above (TLS, HTTP/2, HTTP) are the client's own.

Last 7 days (2 observations)

Distinct clients per day (last 30 days, peak 28/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

TCP window	`64240`
Option kinds	`2-4-8-1-3`
MSS	`1440`
Window scale	`10`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1516h2_8daaf6152771_d8a2da3f94cd` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 149.0.7827.102, chrome 149.0.7827.102, chrome 149.0.7827.156, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	80
`t13d1812h1_85036bcba153_b26ce05bbdd6`	31
`t13d1617h2_86a278354501_3cbfd9057e0d` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 152.0.3, +10 more.The fingerprint page shows the full measured match list. More on the catalog.	13
`t13d1516h1_8daaf6152771_d8a2da3f94cd`	8
`t13d5212h1_b262b3658495_8e6e362c5eac` Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 24.19.0, node-fetch 22.23.1, node-fetch 24.21.0, +6 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`t13d1616h2_86a278354501_fe7c3632a08d`	4
`t13d5911h1_a33745022dd6_1f22a2ca17c4` Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 23.11.1.The fingerprint page shows the full measured match list. More on the catalog.	2
`t13d131100_f57a46bbacb6_ab7e3b40a677` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.5, go-net/http 1.26.4.The fingerprint page shows the full measured match list. More on the catalog.	2
`t13d1812h1_85036bcba153_d41ae481755e`	2
`t13d1011h2_61a7ad8aa9b6_f9531d972513` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.13.4, rust-hyper 1.11.0, rust-hyper 1.11.1, +1 more.The fingerprint page shows the full measured match list. More on the catalog.	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nn11enus_dbdd560af68b_000000000000_000000000000`	36
`ge20nn13enus_0c2c1d640f3e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 151.0.7922.137, chrome 151.0.7922.170, chrome 151.0.7922.108, +23 more.The fingerprint page shows the full measured match list. More on the catalog.	28
`ge11nn050000_b223a0ebb0b5_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.	27
`ge20nn13enus_fcb564d9f630_000000000000_000000000000`	10
`ge20nn11enus_3901d4197baf_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 153.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	6
`ge11nn06frfr_fb4afd1f380a_000000000000_000000000000`	4
`ge20nr12enus_979a40433f82_000000000000_000000000000`	4
`ge20nr10enus_b3034183f430_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +21 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`ge11nr14engb_535d0194b751_000000000000_000000000000`	4
`ge20nr110000_65ce3e7a57b3_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 151.0.7922.34, chromium 148.0.7778.96, chromium 147.0.7727.15, +12 more.The fingerprint page shows the full measured match list. More on the catalog.	3

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 149.0.7827.102, +59 more.The fingerprint page shows the full measured match list. More on the catalog.	74
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	6
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:42\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +43 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`1:65536;2:0;4:131072;5:16384\|12517377\|11:0:0:42\|m,p,a,s`	3
`1:65536;2:0;4:131072;5:16384\|12517377\|5:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 154.0, firefox 153.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`1:65536;2:0;4:131072;5:16384\|12517377\|7:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 155.0, firefox 154.0, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`1:65536;2:0;4:131072;5:16384\|12517377\|13:0:0:42\|m,p,a,s`	2
`1:65536;2:0;4:6291456;6:262144\|15663105\|5:1:0:256\|m,a,s,p`	1
`2:0;4:2097152;5:16384;6:16384\|5177345\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.13.4, rust-reqwest 0.12.28, rust-reqwest 0.13.5, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	1

TCP SYN (p0f)

fingerprint	co-occurrences
`4:50+14:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	29
`4:46+18:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	26
`4:48+16:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	22
`4:44+20:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	19
`4:45+19:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	18
`4:49+15:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	17
`4:43+21:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	12
`4:47+17:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	9
`4:51+13:0:1440:mss*44,10:mss,sok,ts,nop,ws:df,id+:0`	3

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36`	72
`python-requests/2.34.2`	27
`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0`	15
`Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0`	5
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36`	4
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`	4
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36`	3
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36`	2
`Go-http-client/1.1`	2
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36`	2

Country

fingerprint	co-occurrences
`US` · United States	126
`VN` · Vietnam	18
`TR` · Turkey	5
`KE` · Kenya	3
`AU` · Australia	1
`NL` · Netherlands	1
`MX` · Mexico	1

Network (ASN)

fingerprint	co-occurrences
`AS8075` · Microsoft Corporation	129
`AS24088` · Hanoi Telecom Joint Stock Company - HCMC Branch	18
`AS15924` · Vodafone Net Iletisim Hizmetler AS	5
`AS329044` · Surf Net Solutions Limited	3

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprint	linked observations
`q13d0315h3_55b375c5d22e_dc5437974b47`	2
`q13d0311h3_55b375c5d22e_653d80c3fe9d`	1

fingerprint	co-occurrences
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 149.0.7827.102, +59 more.The fingerprint page shows the full measured match list. More on the catalog.	74
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	6
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:42\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +43 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`1:65536;2:0;4:131072;5:16384\|12517377\|11:0:0:42\|m,p,a,s`	3
`1:65536;2:0;4:131072;5:16384\|12517377\|5:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 154.0, firefox 153.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`1:65536;2:0;4:131072;5:16384\|12517377\|7:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 155.0, firefox 154.0, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`1:65536;2:0;4:131072;5:16384\|12517377\|13:0:0:42\|m,p,a,s`	2
`1:65536;2:0;4:6291456;6:262144\|15663105\|5:1:0:256\|m,a,s,p`	1
`2:0;4:2097152;5:16384;6:16384\|5177345\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.13.4, rust-reqwest 0.12.28, rust-reqwest 0.13.5, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	1