TLS ClientHello (JA4)

t13d1911h2_9dc949149365_e7c285222651

first seen 2026-06-14 11:13 · last seen 2026-10-31 23:56 · JSON

Last 7 days (4 observations)

Distinct clients per day (last 30 days, peak 3/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count19
Extension count11
ALPNh2
Ciphers000a, 002f, 0035, 009c, 009d, 1301, 1302, 1303, c009, c00a, c012, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 002b, 0033, ff01
Signature algorithms0804, 0403, 0807, 0805, 0806, 0401, 0501, 0601, 0503, 0603, 0201, 0203
JA4_rt13d1911h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203
JA4_o (sample)t13d1911h2_b565e0f3de94_76bc775a3afc
JA4_ro (sample)t13d1911h2_c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,009c,009d,002f,0035,c012,000a,1301,1302,1303_0000,0005,000a,000b,000d,ff01,0017,0010,0012,002b,0033_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn04zhcn_4bdba6e1e609_000000000000_00000000000016
ge20nr010000_73b42ef9ea4d_000000000000_00000000000011
ge20nn04zhcn_6e6dd1d8c348_000000000000_0000000000007
ge20nn04zhcn_000ee8a720b8_000000000000_0000000000007
ge20nn04zhcn_ed9f6fd839a8_000000000000_0000000000005
ge20nr10enus_b3034183f430_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 155.0.1, +28 more.The fingerprint page shows the full measured match list. More on the catalog.4
ge20nr030000_c01b3bb5abd4_000000000000_0000000000003
ge20nr020000_b89ce445e0b3_000000000000_0000000000003
ge20nr030000_bf75ddd0bb29_000000000000_0000000000003
ge20nr030000_80b089f68b8e_000000000000_0000000000002

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:4194304;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.23.12.The fingerprint page shows the full measured match list. More on the catalog.61
1:65536;2:0;4:131072;5:16384|12517377|3:0:0:22|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 155.0.1, +32 more.The fingerprint page shows the full measured match list. More on the catalog.2
1:65536;2:0;4:131072;5:16384|12517377|3:0:0:42|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.1
2:0;4:4194304;5:16384;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.10, go-net/http 1.26.9, +8 more.The fingerprint page shows the full measured match list. More on the catalog.1
1:65536;2:0;4:131072;5:16384|12517377|5:0:0:22|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 154.0, firefox 153.0, +13 more.The fingerprint page shows the full measured match list. More on the catalog.1
1:65536;2:0;4:131072;5:16384|12517377|7:0:0:22|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 158.0.1, firefox 155.0, +4 more.The fingerprint page shows the full measured match list. More on the catalog.1

TCP SYN (p0f)

fingerprintco-occurrences
4:46+18:0:1412:mss*1,9:mss,sok,ts,nop,ws:df,id+:011
4:248+7:0:1460:8190,8:mss,nop,ws,nop,nop,sok:df,id+:06
4:43+21:0:1412:mss*1,9:mss,sok,ts,nop,ws:df,id+:06
4:45+19:0:1412:mss*46,7:mss,sok,ts,nop,ws:df,id+:05
4:45+19:0:1412:mss*1,9:mss,sok,ts,nop,ws:df,id+:05
4:48+16:0:1460:mss*1,9:mss,sok,ts,nop,ws:df,id+:05
4:51+13:0:1260:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:05
4:47+17:0:1412:mss*46,7:mss,sok,ts,nop,ws:df,id+:03
4:47+17:0:1460:mss*1,9:mss,sok,ts,nop,ws:df,id+:03
4:49+15:0:1460:mss*1,9:mss,sok,ts,nop,ws:df,id+:02

TCP SYN (JA4T)

fingerprintco-occurrences
1412_2-4-8-1-3_1412_925
64952_2-4-8-1-3_1412_710
1460_2-4-8-1-3_1460_910
8190_2-1-3-1-1-4_1460_88
65535_2-1-3-1-1-8-4-0-0_1260_65
64240_2-4-8-1-3_1460_71
64240_2-4-8-1-3_1460_101
64240_2-1-3-1-1-4_1460_81
64240_2-1-3-1-1-4_1300_81
64952_2-4-8-1-3_1412_91

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.3638
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.369
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.05
Go-http-client/2.03
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.01

Country

fingerprintco-occurrences
HK · Hong Kong SAR China38
CN · China11
US · United States10
AU · Australia5
ID · Indonesia2
DE · Germany1

Network (ASN)

fingerprintco-occurrences
AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED26
AS9465 · AGOTOZ PTE. LTD.12
AS58466 · CHINANET Guangdong province network11
AS40355 · Sundance International LLC9
AS4826 · Vocus Connect International Backbone5
AS62240 · Clouvider1
AS42730 · EVANZO e-commerce GmbH1
AS139952 · PT Trisari Data Indonusa1
AS152390 · PT Intercloud Digital Inovasi1

TLS supported groups

fingerprintco-occurrences
001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, curl 8.7.1.The fingerprint page shows the full measured match list. More on the catalog.9