TLS ClientHello (JA4)

t13d1613h2_86a278354501_748f4c70de1c

first seen 2026-07-06 07:18 · last seen 2026-07-24 12:27 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count16
Extension count13
ALPNh2
Ciphers002f, 0035, 009c, 009d, 1301, 1302, 1303, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0017, 001c, 0022, 002b, 0033, fe0d, ff01
Signature algorithms0403, 0503, 0603, 0804, 0805, 0806, 0401, 0501, 0601, 0203, 0201
JA4_rt13d1613h2_002f,0035,009c,009d,1301,1302,1303,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,001c,0022,002b,0033,fe0d,ff01_0403,0503,0603,0804,0805,0806,0401,0501,0601,0203,0201
JA4_o (sample)t13d1613h2_d6294ab6b85e_b9d95c74ef12
JA4_ro (sample)t13d1613h2_1301,1303,1302,c02b,c02f,cca9,cca8,c02c,c030,c00a,c013,c014,009c,009d,002f,0035_0000,0017,ff01,000a,000b,0010,0005,0022,0033,002b,000d,001c,fe0d_0403,0503,0603,0804,0805,0806,0401,0501,0601,0203,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nr11enus_187a9385d229_000000000000_0000000000003
ge20nr11frfr_187a9385d229_000000000000_0000000000003
ge20nr11enit_187a9385d229_000000000000_0000000000001
ge20nn11enus_684b26f0fcdf_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:4096;2:0;4:32768;5:16384|12517377|3:0:0:22|m,p,a,s5
1:4096;2:0;4:32768;5:16384|12517377|3:0:0:42|m,p,a,s1
1:4096;2:0;4:32768;5:16384|12517377|5:0:0:22|m,p,a,s1
1:4096;2:0;4:32768;5:16384|12517377|7:0:0:22|m,p,a,s1

TCP SYN (p0f)

fingerprintco-occurrences
4:241+14:0:1420:mss*42,8:mss,nop,ws,sok,ts:df,id+:04
4:46+18:0:1412:65535,8:mss,sok,ts,nop,ws:df,id+:01
6:48+16:0:1420:mss*42,8:mss,nop,ws,sok,ts::01
6:49+15:0:1420:mss*42,8:mss,nop,ws,sok,ts::01
6:46+18:0:1420:mss*42,8:mss,nop,ws,sok,ts::01

TCP SYN (JA4T)

fingerprintco-occurrences
59640_2-1-3-4-8_1420_87
65535_2-4-8-1-3_1412_81

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Android 11; Mobile; rv:152.0) Gecko/152.0 Firefox/152.04
Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.02
Mozilla/5.0 (Android 10; Mobile; rv:152.0) Gecko/152.0 Firefox/152.01
Mozilla/5.0 (Android 16; Mobile; rv:153.0) Gecko/153.0 Firefox/153.01

Country

fingerprintco-occurrences
FR · France7
IT · Italy1

Network (ASN)

fingerprintco-occurrences
AS15557 · Societe Francaise Du Radiotelephone - SFR SA7
AS12874 · Fastweb SpA1

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
q13d0315h3_55b375c5d22e_dc5437974b474