TCP SYN (p0f)
4:238+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0
first seen 2026-07-27 11:00 · last seen 2026-09-23 19:20 · JSON
Decomposed attributes
| IP version | 4 |
| Initial TTL | 238+17 |
| Options length | 0 |
| MSS | 1440 |
| Window size | 65535 |
| Window scale | 6 |
| Options layout | mss,sok,ts,nop,ws |
| Quirks | df,id+ |
| Payload class | 0 |
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
TLS ClientHello (JA4)
HTTP request (JA4H)
TCP SYN (JA4T)
User-Agent
Country
| fingerprint | co-occurrences |
BR · Brazil | 5 |
BD · Bangladesh | 1 |
Network (ASN)
| fingerprint | co-occurrences |
AS28198 · SEMPRE TELECOMUNICACOES LTDA | 3 |
AS27699 · TELEFÔNICA BRASIL S.A | 1 |
AS134806 · Skyview Online Ltd | 1 |
AS269504 · Paulo Dos Santos Teixeira Junior | 1 |