TCP SYN (p0f)

4:44+20:0:1412:mss*46,7:mss,sok,ts,nop,ws:df,id+:0

first seen 2026-07-03 07:29 · last seen 2026-10-11 19:15 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

IP version4
Initial TTL44+20
Options length0
MSS1412
Window sizemss*46
Window scale7
Options layoutmss,sok,ts,nop,ws
Quirksdf,id+
Payload class0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d191000_9dc949149365_e7c28522265132
t13i170900_5b57614c22b0_78e6aca7449b2

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn040000_8391bea91fb6_000000000000_00000000000029
ge11nn030000_32287c24fa5b_000000000000_0000000000003
ge11nn070000_fd2827074311_000000000000_0000000000001
ge11nn050000_7c1f178bff36_000000000000_0000000000001

TCP SYN (JA4T)

fingerprintco-occurrences
64952_2-4-8-1-3_1412_734

User-Agent

fingerprintco-occurrences
Go-http-client/1.116
curl/7.29.03
libredtail-http2
Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/571.43 (KHTML, like Gecko) Chrome/72.0.2988 Safari/537.361
Mozilla/5.0 (Windows NT 7_1_1; Win64; x64) AppleWebKit/601.51 (KHTML, like Gecko) Chrome/75.0.401 Safari/537.361
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/550.55 (KHTML, like Gecko) Chrome/53.0.1293 Safari/537.361
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/553.48 (KHTML, like Gecko) Chrome/72.0.411 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2) AppleWebKit/582.43 (KHTML, like Gecko) Chrome/98.0.2821 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2) AppleWebKit/566.50 (KHTML, like Gecko) Chrome/98.0.949 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2_1) AppleWebKit/559.52 (KHTML, like Gecko) Chrome/93.0.2915 Safari/537.361

Country

fingerprintco-occurrences
HK · Hong Kong SAR China20
TH · Thailand10
GB · United Kingdom2
CN · China2

Network (ASN)

fingerprintco-occurrences
AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED32
AS23724 · IDC, China Telecommunications Corporation2