TLS ClientHello (JA4)

t12d290700_fc2078a0b8c0_8c06664c3ac5

first seen 2026-06-15 20:21 · last seen 2026-09-16 12:52 · JSON

Last 7 days (159 observations)

Distinct clients per day (last 30 days, peak 18/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version12
SNId (domain)
Cipher count29
Extension count7
ALPN00
Ciphers000a, 002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, cc13, cc14, cca8, cca9
Extensions000a, 000b, 000d, 0017, 0023, ff01
Signature algorithms0601, 0603, 0501, 0503, 0401, 0403, 0201, 0203
JA4_rt12d290700_000a,002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cc13,cc14,cca8,cca9_000a,000b,000d,0017,0023,ff01_0601,0603,0501,0503,0401,0403,0201,0203
JA4_o (sample)t12d290700_a17167f2a10d_9add04999458
JA4_ro (sample)t12d290700_c02b,c02f,009e,c02c,c030,009f,cca9,cca8,cc14,cc13,c009,c023,c013,c027,0033,0067,c00a,c024,c014,c028,0039,006b,009c,009d,002f,003c,0035,003d,000a_ff01,0000,0017,0023,000d,000b,000a_0601,0603,0501,0503,0401,0403,0201,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn040000_bfa5a9b89dd6_000000000000_000000000000227
ge11nn05en00_61812dc1cc58_000000000000_000000000000159
ge11nn06en00_3011d71998e2_000000000000_00000000000080
ge11nn030000_dd98166e0881_000000000000_00000000000043
ge11nn030000_341eb0d8946c_000000000000_00000000000013
ge11nn05en00_e3dbea9fc70c_000000000000_0000000000007
ge11nn040000_d368c19b6155_000000000000_0000000000006

TCP SYN (p0f)

fingerprintco-occurrences
6:49+15:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:058
4:45+19:0:1460:mss*44,7:mss,sok,ts,nop,ws::055
6:46+18:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:049
6:48+16:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:040
6:50+14:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:031
6:44+20:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:028
4:46+18:0:1460:65535,9:mss,nop,nop,sok,nop,ws::020
6:49+15:0:1440:mss*45,10:mss,sok,ts,nop,ws:flow:016
6:47+17:0:1440:65535,9:mss,sok,ts,nop,ws:ecn,flow:016
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws::015

TCP SYN (JA4T)

fingerprintco-occurrences
64800_2-4-8-1-3_1440_7231
64240_2-4-8-1-3_1460_796
65535_2-1-1-4-1-3_1440_941
64800_2-4-8-1-3_1440_1029
65535_2-4-8-1-3_1440_924
65535_2-1-1-4-1-3_1460_920
64240_2-4-8-1-3_1460_818
42340_2-1-1-4-1-3_1460_1114
65535_2-4-8-1-3_1460_912
64240_2-4-8-1-3_1460_106

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)535

Country

fingerprintco-occurrences
FR · France350
FI · Finland54
NO · Norway39
DE · Germany33
UA · Ukraine23
PL · Poland15
HK · Hong Kong SAR China8
SG · Singapore6
SE · Sweden4
AT · Austria3

Network (ASN)

fingerprintco-occurrences
AS16276 · OVH SAS329
AS24940 · Hetzner Online GmbH64
AS51167 · Contabo GmbH36
AS29695 · Lyse Tele AS32
AS197540 · netcup GmbH14
AS48230 · LLC MONOLITH.NET14
AS4760 · HKT Limited8
AS2119 · Telenor Norge AS7
AS13188 · CONTENT DELIVERY NETWORK LTD7
AS6939 · Hurricane Electric LLC6