TLS ClientHello (JA4)

t13d1810h2_228bd4bf6806_cf80c7f419ad

first seen 2026-07-06 15:14 · last seen 2026-07-06 15:14 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count18
Extension count10
ALPNh2
Ciphers00ff, 1301, 1302, 1303, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, cca8, cca9
Extensions000a, 000b, 000d, 0016, 0017, 002b, 002d, 0033
Signature algorithms0403, 0503, 0603, 0806, 0805, 0804, 0601, 0501, 0401
JA4_rt13d1810h2_00ff,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0016,0017,002b,002d,0033_0403,0503,0603,0806,0805,0804,0601,0501,0401
JA4_o (sample)t13d1810h2_dd55891ebfd6_831065bbc9fc
JA4_ro (sample)t13d1810h2_1303,1302,1301,cca8,cca9,c02c,c030,c024,c028,c00a,c014,c02b,c02f,c023,c027,c009,c013,00ff_0000,0010,002b,0033,002d,000a,000d,000b,0016,0017_0403,0503,0603,0806,0805,0804,0601,0501,0401

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.13.0, +11 more.The fingerprint page shows the full measured match list. More on the catalog.1

HTTP/2 frames (Akamai)

fingerprintco-occurrences
3:100;4:65536;2:0|1048510465|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.1

TCP SYN (p0f)

fingerprintco-occurrences
4:48+16:0:1460:mss*44,5:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_51

User-Agent

fingerprintco-occurrences
curl/8.12.11

Country

fingerprintco-occurrences
RU · Russia1

Network (ASN)

fingerprintco-occurrences
AS8402 · PJSC "Vimpelcom"1