TLS ClientHello (JA4)

t12d070400_67e63544eb68_b4ef8340317f

first seen 2026-09-17 20:20 · last seen 2026-09-18 17:52 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version12
SNId (domain)
Cipher count7
Extension count4
ALPN00
Ciphers002f, 0035, 009c, c02b, c02c, c02f, c030
Extensions000a, 000b, 000d
Signature algorithms0503, 0403, 0601, 0501, 0401, 0201
JA4_rt12d070400_002f,0035,009c,c02b,c02c,c02f,c030_000a,000b,000d_0503,0403,0601,0501,0401,0201
JA4_o (sample)t12d070400_c2ebe5c3deb8_b3d226d49e93
JA4_ro (sample)t12d070400_c02c,c030,c02b,c02f,009c,0035,002f_000d,000a,000b,0000_0503,0403,0601,0501,0401,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn040000_5607f20fd643_000000000000_00000000000015
ge11nn030000_0d34275228c4_000000000000_00000000000012

TCP SYN (p0f)

fingerprintco-occurrences
4:48+16:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:010
4:54+10:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:08
4:50+14:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:06
4:49+15:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:03

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_1027

User-Agent

fingerprintco-occurrences
Ktor client15
ktor-client12

Country

fingerprintco-occurrences
US · United States18
NL · Netherlands9

Network (ASN)

fingerprintco-occurrences
AS132892 · Cloudflare, Inc.18
AS202623 · Cloudflare Inc9