TLS ClientHello (JA4)

t13d1812h1_5d04281c6031_ef7df7f74e48

first seen 2026-07-10 07:22 · last seen 2026-08-19 12:16 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count18
Extension count12
ALPNh1
Ciphers002f, 0035, 009c, 009d, 1301, 1302, 1303, c009, c00a, c013, c014, c027, c02b, c02c, c02f, c030, cca8, cca9
Extensions000a, 000b, 000d, 0015, 0017, 0023, 002b, 002d, 0033, ff01
Signature algorithms0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601, 0201
JA4_rt13d1812h1_002f,0035,009c,009d,1301,1302,1303,c009,c00a,c013,c014,c027,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0015,0017,0023,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0501,0806,0601,0201
JA4_o (sample)t13d1812h1_04134bd58ce0_660b27e01e73
JA4_ro (sample)t13d1812h1_1301,1302,1303,c02f,c02b,c030,c02c,c027,cca9,cca8,c009,c013,c00a,c014,009c,009d,002f,0035_0000,0017,ff01,000a,000b,0023,0010,000d,0033,002d,002b,0015_0403,0804,0401,0503,0805,0501,0806,0601,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn09enus_86ddd74de9f3_000000000000_0000000000003
ge11nn07enus_6c5989145a61_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:112+16:0:1452:65535,8:mss,nop,ws,nop,nop,sok:df,id+:02
4:110+18:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01
6:47+17:0:1360:65535,13:mss,sok,ts,nop,ws:flow:01

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-1-3-1-1-4_1452_82
65535_2-1-3-1-1-4_1460_81
65535_2-4-8-1-3_1360_131

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.364

Country

fingerprintco-occurrences
CN · China2
GB · United Kingdom1
FI · Finland1

Network (ASN)

fingerprintco-occurrences
AS4134 · CHINANET BACKBONE2
AS13335 · Cloudflare, Inc.1
AS5089 · Virgin Media Limited1