TLS ClientHello (JA4)

t13d1812h1_85036bcba153_d41ae481755e

first seen 2026-06-14 10:07 · last seen 2026-10-31 15:16 · JSON

Last 7 days (12 observations)

Distinct clients per day (last 30 days, peak 4/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count18
Extension count12
ALPNh1
Ciphers0067, 006b, 009e, 009f, 00ff, 1301, 1302, 1303, c023, c024, c027, c028, c02b, c02c, c02f, c030, cca8, cca9
Extensions000a, 000b, 000d, 0015, 0016, 0017, 0023, 002b, 002d, 0033
Signature algorithms0403, 0503, 0603, 0807, 0808, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0301, 0302, 0402, 0502, 0602
JA4_rt13d1812h1_0067,006b,009e,009f,00ff,1301,1302,1303,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0015,0016,0017,0023,002b,002d,0033_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602
JA4_o (sample)t13d1812h1_a2fb288ce784_958d92f00bb5
JA4_ro (sample)t13d1812h1_1302,1303,1301,c02c,c030,c02b,c02f,cca9,cca8,c024,c028,c023,c027,009f,009e,006b,0067,00ff_0000,000b,000a,0023,0010,0016,0017,000d,002b,002d,0033,0015_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn040000_e1d2031bdfea_000000000000_00000000000058
ge11nn050000_3658ef221638_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.25.0, wget 1.21.3.The fingerprint page shows the full measured match list. More on the catalog.29
po20nn07*000_8db2b212706a_000000000000_00000000000023
ge20nn06*000_b74359a06b81_000000000000_00000000000023
ge11nn050000_be0d0b335e46_000000000000_00000000000021
ge20nn060000_9606e9a08f5b_000000000000_00000000000012
ge11nn060000_a284f3d85baf_000000000000_00000000000011
ge11nn05enus_16a7191cb35b_000000000000_00000000000010
ge11nn040000_88d30a62b7ad_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog.9
po11nr10enus_af6b54c809f5_000000000000_0000000000008

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:4096;2:0;4:65535;5:16384;3:100;6:65536|16777216|0|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.62

TCP SYN (p0f)

fingerprintco-occurrences
6:52+12:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:021
4:118+10:0:1460:62720,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:019
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:018
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:011
6:51+13:0:1440:62587,7:mss,sok,ts,nop,ws:flow:011
6:48+16:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:010
4:57+7:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:09
4:45+19:0:1440:mss*44,9:mss,sok,ts,nop,ws:df,id+:08
4:58+6:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:07
6:47+17:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:06

TCP SYN (JA4T)

fingerprintco-occurrences
64800_2-4-8-1-3_1440_757
64240_2-4-8-1-3_1460_744
62720_2-1-3-1-1-4_1460_824
65535_2-1-3-1-1-4_1440_817
64240_2-1-3-1-1-4_1460_815
62587_2-4-8-1-3_1440_713
64240_2-4-8-1-3_1440_912
65535_2-1-3-1-1-4_1460_89
65280_2-1-3-1-1-4_1360_86
64240_2-4-8-1-3_1412_75

User-Agent

fingerprintco-occurrences
python-httpx/0.28.153
Mozilla/5.0 HackerNews Ingestor23
Pandalytics/2.0 (+https://domainsbot.com/network-crawler-pandalytics-kdc68dhsbd/)17
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.3615
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; AzureAI-SearchBot/1.0;14
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.3612
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.012
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.3611
Mozilla/5.0 (Android 10; Mobile; rv:89.0) Gecko/89.0 Firefox/89.08
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.366

Country

fingerprintco-occurrences
US · United States103
NL · Netherlands43
AU · Australia19
IE · Ireland17
IT · Italy16
CN · China12
DE · Germany8
SG · Singapore6
FR · France5
SA · Saudi Arabia5

Network (ASN)

fingerprintco-occurrences
AS8075 · Microsoft Corporation37
AS21859 · Zenlayer Inc28
AS31898 · Oracle Corporation28
AS11426 · Charter Communications Inc23
AS16509 · Amazon.com, Inc.20
AS211680 · NSEC - Sistemas Informaticos, S.A.20
AS197170 · TechTies Inc.11
AS4134 · CHINANET BACKBONE10
AS396982 · Google LLC9
AS206264 · Amarutu Technology Ltd7

TLS supported groups

fingerprintco-occurrences
001d,0017,001e,0019,0018,0100,0101,0102,0103,0104 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, php-guzzle 8.3.1, curl 7.88.1, +10 more.The fingerprint page shows the full measured match list. More on the catalog.41
001d,0017,001e,0019,00189