TCP SYN (p0f)

4:50+14:0:1280:mss*51,10:mss,sok,ts,nop,ws:df,id+:0

first seen 2026-08-12 07:01 · last seen 2026-10-23 15:24 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

IP version4
Initial TTL50+14
Options length0
MSS1280
Window sizemss*51
Window scale10
Options layoutmss,sok,ts,nop,ws
Quirksdf,id+
Payload class0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1312h2_f57a46bbacb6_f50d94e863eb Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.1, go-net/http 1.27.3, go-net/http 1.27.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.4
t13d1312h2_f57a46bbacb6_ab7e3b40a677 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.10, go-net/http 1.26.9, +7 more.The fingerprint page shows the full measured match list. More on the catalog.3

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn020000_b89ce445e0b3_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.27.1, go-net/http 1.27.3, +14 more.The fingerprint page shows the full measured match list. More on the catalog.6
ge20nn020000_fb4f949fd323_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.9, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.1

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:4194304;5:1048576;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.1, go-net/http 1.27.3, go-net/http 1.27.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.4
2:0;4:4194304;5:16384;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.10, go-net/http 1.26.9, +8 more.The fingerprint page shows the full measured match list. More on the catalog.3

TCP SYN (JA4T)

fingerprintco-occurrences
65280_2-4-8-1-3_1280_107

User-Agent

fingerprintco-occurrences
Go-http-client/2.06
scrape_central/1.01

Country

fingerprintco-occurrences
NL · Netherlands7

Network (ASN)

fingerprintco-occurrences
AS212238 · Datacamp Limited3
AS43357 · Owl Limited2
AS39351 · 31173 Services AB2

TLS supported groups

fingerprintco-occurrences
11ec,11eb,11ed,001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.3, go-net/http 1.26.10.The fingerprint page shows the full measured match list. More on the catalog.3