TCP SYN (p0f)

4:51+13:0:8960:mss*7,7:mss,sok,ts,nop,ws:df,id+:0

first seen 2026-08-17 22:46 · last seen 2026-10-12 02:43 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

IP version4
Initial TTL51+13
Options length0
MSS8960
Window sizemss*7
Window scale7
Options layoutmss,sok,ts,nop,ws
Quirksdf,id+
Payload class0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1516h2_8daaf6152771_e5627efa2ab11
t13d1512h2_8daaf6152771_cbb9361b6bf91
t13d1310h2_de7442f7cdaa_5603904660151
t13d0710h2_338ad415f265_5603904660151
t13d0911h2_57087a359cb4_9ced094328c91
t13d0911h2_350262f76fa2_9ced094328c91
t13d1311h2_aac5d8fbee66_9ced094328c91
t13d1011h2_cdfb91a0a52b_9ced094328c91
t13d1210h2_1b775afd87c7_5603904660151

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn04enus_989c7cc05c9b_000000000000_0000000000008
ge20nn12enus_60f823d07c94_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:65536;2:0;4:6291456;6:262144;4:1048576|15663105|1:0:0:256|m,a,s,p8
1:65536;2:0;3:1000;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p1

TCP SYN (JA4T)

fingerprintco-occurrences
62720_2-4-8-1-3_8960_79

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.151
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.3 Safari/537.36 Edg/135.0.0.31
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.8 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.9 Safari/537.361
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.3 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.106 Safari/537.36 Edge/18.195821
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.8 Safari/537.36 Edg/134.0.0.81
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.2 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.8 Safari/605.1.151

Country

fingerprintco-occurrences
SE · Sweden5
FR · France3
US · United States1

Network (ASN)

fingerprintco-occurrences
AS33837 · Fredrik Holmqvist5
AS213873 · OUIDO Hosting3
AS62744 · Quintex Alliance Consulting1