TCP SYN (JA4T)

42340_2-4-8-1-3_1440_7

first seen 2026-06-29 23:40 · last seen 2026-10-31 01:10 · JSON

Last 7 days (4 observations)

Distinct clients per day (last 30 days, peak 3/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

TCP window	`42340`
Option kinds	`2-4-8-1-3`
MSS	`1440`
Window scale	`7`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d131100_f57a46bbacb6_ab7e3b40a677` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.5, go-net/http 1.26.4.The fingerprint page shows the full measured match list. More on the catalog.	86
`t13d1312h2_f57a46bbacb6_ab7e3b40a677` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.10, go-net/http 1.26.9, +7 more.The fingerprint page shows the full measured match list. More on the catalog.	19
`t13d1516h2_8daaf6152771_806a8c22fdea` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chrome 151.0.7922.137, chromium 151.0.7922.34, +28 more.The fingerprint page shows the full measured match list. More on the catalog.	3

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nr09enus_ac151016e6e5_000000000000_000000000000`	58
`ge11nn080000_f57775ada363_000000000000_000000000000`	16
`ge20nn030000_ff50983941c1_000000000000_000000000000`	14
`ge11nr06enus_a89d28968959_000000000000_000000000000`	8
`ge11nr080000_f57775ada363_000000000000_000000000000`	4
`ge20nr030000_ff50983941c1_000000000000_000000000000`	3
`ge20nr030000_80b089f68b8e_000000000000_000000000000`	1
`ge20nn16enus_9a119c50b7b2_000000000000_000000000000`	1
`ge20nr15enus_73685ad2097f_000000000000_000000000000`	1
`ge20nr15enus_0c2922224a95_000000000000_000000000000`	1

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`2:0;4:4194304;5:16384;6:10485760\|1073741824\|0\|a,m,p,s` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.10, go-net/http 1.26.9, +8 more.The fingerprint page shows the full measured match list. More on the catalog.	19
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 152.0.7977.83, +81 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +57 more.The fingerprint page shows the full measured match list. More on the catalog.	1

TCP SYN (p0f)

fingerprint	co-occurrences
`4:46+18:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	29
`4:43+21:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	18
`4:44+20:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	17
`4:45+19:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	16
`4:49+15:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	9
`4:48+16:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	8
`4:42+22:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	7
`4:47+17:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	3
`4:51+13:0:1440:mss*29,7:mss,sok,ts,nop,ws:df,id+:0`	1

User-Agent

fingerprint	co-occurrences
`DuckDuckBot/1.1; (+http://duckduckgo.com/duckduckbot.html)`	66
`DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)`	21
`DuckDuckBot/1.0; (+http://duckduckgo.com/duckduckbot.html)`	21

Country

fingerprint	co-occurrences
`US` · United States	70
`IE` · Ireland	38

Network (ASN)

fingerprint	co-occurrences
`AS8075` · Microsoft Corporation	108

TLS supported groups

fingerprint	co-occurrences
`11ec,11eb,11ed,001d,0017,0018,0019` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.3, go-net/http 1.26.10.The fingerprint page shows the full measured match list. More on the catalog.	10