TCP SYN (JA4T)

43648_2-4-8-1-3_1420_9

first seen 2026-08-28 20:23 · last seen 2026-09-14 05:16 · JSON

Decomposed attributes

TCP window43648
Option kinds2-4-8-1-3
MSS1420
Window scale9

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d131300_f57a46bbacb6_1bd98dace7755
t13d131200_f57a46bbacb6_9249cab70c772

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn05enus_f3bb7aa45ec4_000000000000_0000000000003
ge11nr05enus_f3bb7aa45ec4_000000000000_0000000000003
ge11nn060000_6f1c3d56a901_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:58+6:0:1420:mss*31,9:mss,sok,ts,nop,ws:df,id+,ts2+:07

User-Agent

fingerprintco-occurrences
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)1
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.5780.193 Safari/537.36; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user1
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; LinkedInBot/1.0; +http://www.linkedin.com) Chrome/114.0.6420.45 Safari/537.361
Mozilla/5.0 (compatible; Claude-SearchBot/1.0; +https://www.anthropic.com/claude-searchbot)1
Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6850.59 Mobile Safari/537.36; compatible; TelegramBot/1.01
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.4071.193 Safari/537.36 Edg/133.0.4071.193; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user1
Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:132.13) Gecko/20100101 Firefox/132.13; compatible; Twitterbot/1.01

Country

fingerprintco-occurrences
TW · Taiwan5
US · United States2

Network (ASN)

fingerprintco-occurrences
AS396982 · Google LLC7