TCP SYN (JA4T)

65535_2-1-3-1-1-8-4-0-0_1250_6

first seen 2026-07-01 16:16 · last seen 2026-10-23 12:24 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

TCP window	`65535`
Option kinds	`2-1-3-1-1-8-4-0-0`
MSS	`1250`
Window scale	`6`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1516h2_8daaf6152771_806a8c22fdea` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chrome 151.0.7922.137, chromium 151.0.7922.34, +28 more.The fingerprint page shows the full measured match list. More on the catalog.	7
`t13d210900_6b2954d954da_00596cb448ee`	5
`t13d171000_5b57614c22b0_78e6aca7449b`	3
`t13d2013h2_a09f3c656075_7f0f34a4126d` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.4, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`t13d171100_ab0a1bf427ad_8e6e362c5eac`	2
`t13d5911h1_a33745022dd6_1f22a2ca17c4` Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 23.11.1.The fingerprint page shows the full measured match list. More on the catalog.	1
`t13d4907h2_0d8feac7bc37_7395dae3b2f3` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1.The fingerprint page shows the full measured match list. More on the catalog.	1
`t13d1515h2_8daaf6152771_a54fffd0eb61`	1
`t12d3805h1_10ed599f3404_aaf95bb78ec9`	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nr12enus_54b4638ab28b_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chrome 152.0.7977.83, chrome 151.0.7922.137, +58 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`ge20nr09enus_5ad46a65401a_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.6.1, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`ge11nn050000_ea6f06182064_000000000000_000000000000`	2
`ge11nr11engb_d21348767826_000000000000_000000000000`	2
`ge11nr13kokr_695efbec79f4_000000000000_000000000000`	2
`ge20nn020000_5594a17e7e7e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.13.0, +11 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`ge20nr11enus_187a9385d229_000000000000_000000000000`	1
`ge11nn050000_b223a0ebb0b5_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.	1
`ge20nn13enus_0c2c1d640f3e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 151.0.7922.137, chrome 151.0.7922.170, chrome 151.0.7922.108, +36 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`ge20nr13enus_5907f7c6644a_000000000000_000000000000`	1

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 152.0.7977.83, +81 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +57 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`2:0;3:100;4:2097152;9:1\|10420225\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.5, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 155.0.1, +31 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`3:100;4:10485760;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0.The fingerprint page shows the full measured match list. More on the catalog.	1
`1:65536;2:0;4:6291456;6:262144\|15663105\|3:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 151.0.7922.34, chromium 147.0.7727.15, chromium 145.0.7632.6, +26 more.The fingerprint page shows the full measured match list. More on the catalog.	1

TCP SYN (p0f)

fingerprint	co-occurrences
`6:50+14:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:ecn,flow:0`	6
`4:44+20:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:0`	5
`4:41+23:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:0`	3
`4:45+19:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:0`	3
`6:53+11:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:ecn,flow:0`	2
`4:51+13:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:0`	1
`4:53+11:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:0`	1
`4:41+23:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:0`	1
`4:52+12:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:0`	1

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36`	7
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36`	5
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15`	3
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Safari/605.1.15`	2
`cf-defaults-research/0.1 (academic research; fetches robots.txt and homepage once)`	2
`curl/8.7.1`	1
`Mozilla/5.0 (compatible; Growero/1.0; +https://growero.io)`	1
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0`	1
`Mozilla/5.0 (quiethumans rescan; personal-site index)`	1

Country

fingerprint	co-occurrences
`US` · United States	8
`KR` · South Korea	5
`RO` · Romania	3
`IN` · India	3
`DE` · Germany	2
`EE` · Estonia	1
`AT` · Austria	1

Network (ASN)

fingerprint	co-occurrences
`AS714` · Apple Inc.	8
`AS3786` · LG DACOM Corporation	5
`AS24560` · Bharti Airtel Ltd., Telemedia Services	3
`AS42424` · ICS Endava SRL	3
`AS12816` · Leibniz-Rechenzentrum	2
`AS47736` · IT and Development Center of Ministry of Interior, Estonia	1
`AS60368` · Greentube GmbH	1

TLS supported groups

fingerprint	co-occurrences
`11ec,001d,0017,001e,0018,0019,0100,0101` Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 24.22.1, python-httpx 0.28.1, python-requests 2.34.2, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`001d,0017,0018` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.11.27, powershell 7.6.8, +1 more.The fingerprint page shows the full measured match list. More on the catalog.	1

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprint	linked observations
`q13d0311h3_55b375c5d22e_653d80c3fe9d`	5
`q13d0311h3_55b375c5d22e_f2a83c8e78ae`	2
`q13d0315h3_55b375c5d22e_dc5437974b47`	1

fingerprint	co-occurrences
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 152.0.7977.83, +81 more.The fingerprint page shows the full measured match list. More on the catalog.	4
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +57 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`2:0;3:100;4:2097152;9:1\|10420225\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.5, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`1:65536;2:0;4:131072;5:16384\|12517377\|3:0:0:22\|m,p,a,s` Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 155.0.1, +31 more.The fingerprint page shows the full measured match list. More on the catalog.	1
`3:100;4:10485760;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0.The fingerprint page shows the full measured match list. More on the catalog.	1
`1:65536;2:0;4:6291456;6:262144\|15663105\|3:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 151.0.7922.34, chromium 147.0.7727.15, chromium 145.0.7632.6, +26 more.The fingerprint page shows the full measured match list. More on the catalog.	1