TLS ClientHello (JA4)

t13i170900_5b57614c22b0_78e6aca7449b

first seen 2026-06-11 04:20 · last seen 2026-10-31 05:03 · JSON

Last 7 days (9 observations)

Distinct clients per day (last 30 days, peak 6/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNIi (no SNI / IP)
Cipher count17
Extension count9
ALPN00
Ciphers002f, 0035, 009c, 009d, 1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions000a, 000b, 000d, 0017, 0023, 002b, 002d, 0033, ff01
Signature algorithms0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601, 0201
JA4_rt13i170900_002f,0035,009c,009d,1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0017,0023,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0501,0806,0601,0201
JA4_o (sample)t13i170900_bbc337f0a232_ca0042101dff
JA4_ro (sample)t13i170900_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,009c,009d,002f,0035_0017,ff01,000a,000b,0023,000d,0033,002d,002b_0403,0804,0401,0503,0805,0501,0806,0601,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn070000_d0d63ed74832_000000000000_00000000000071
ge11nn050000_c71bbc472f37_000000000000_00000000000069
ge11nn070000_f395b2c4bb38_000000000000_00000000000021
ge11nn050000_e81ae831f766_000000000000_00000000000021
ge11nn070000_07b5c846fda8_000000000000_00000000000019
ge11nn050000_0c34b9a6def6_000000000000_00000000000019
ge11nn070000_ca40d4d1460e_000000000000_00000000000013
ge11nn070000_fd2827074311_000000000000_00000000000013
ge11nn050000_7c1f178bff36_000000000000_00000000000012
ge11nn050000_889622e8388c_000000000000_00000000000011

TCP SYN (p0f)

fingerprintco-occurrences
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:024
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:021
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:020
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:018
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:014
4:43+21:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:013
4:48+16:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:010
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:010
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:010
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:09

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_7185
64240_2-4-8-1-3_1460_1018
29200_2-4-8-1-3_1460_716
64952_2-4-8-1-3_1412_716
64240_2-4-8-1-3_1424_712
32120_2-4-8-1-3_1460_76
64240_2-4-8-1-3_1360_75
65280_2-4-8-1-3_1360_74
64860_2-4-8-1-3_1410_74
42340_2-4-8-1-3_1460_94

User-Agent

fingerprintco-occurrences
libredtail-http317
Custom-AsyncHttpClient6

Country

fingerprintco-occurrences
US · United States65
ID · Indonesia31
SG · Singapore26
VN · Vietnam26
PK · Pakistan23
CN · China14
FR · France13
HK · Hong Kong SAR China10
GB · United Kingdom10
UZ · Uzbekistan10

Network (ASN)

fingerprintco-occurrences
AS45102 · Alibaba (US) Technology Co., Ltd.26
AS59257 · CMPak Limited21
AS51167 · Contabo GmbH17
AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED17
AS150462 · PT Air Lintas Komunikasi14
AS45090 · Shenzhen Tencent Computer Systems Company Limited10
AS31898 · Oracle Corporation10
AS38733 · CMC Telecom Infrastructure Company10
AS202660 · "Uzbektelekom" Joint Stock Company10
AS14061 · DigitalOcean, LLC8

TLS supported groups

fingerprintco-occurrences
0a0a,11ec,001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: chrome 155.0.8059.40, chrome 156.0.8078.73, chromium 156.0.8078.47, +8 more.The fingerprint page shows the full measured match list. More on the catalog.68