TLS ClientHello (JA4)

t13d4312h1_c7886603b240_b26ce05bbdd6

first seen 2026-06-11 06:40 · last seen 2026-09-16 01:27 · JSON

Last 7 days (110 observations)

Distinct clients per day (last 30 days, peak 42/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocol	`t (TLS over TCP)`
TLS version	`13`
SNI	`d (domain)`
Cipher count	`43`
Extension count	`12`
ALPN	`h1`
Ciphers	`002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, 00ff, 1301, 1302, 1303, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, c09c, c09d, c09e, c09f, c0a0, c0a1, c0a2, c0a3, c0ac, c0ad, c0ae, c0af, cca8, cca9, ccaa`
Extensions	`000a, 000b, 000d, 0015, 0016, 0017, 002b, 002d, 0031, 0033`
Signature algorithms	`0403, 0503, 0603, 0807, 0808, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0301, 0302, 0402, 0502, 0602`
JA4_r	`t13d4312h1_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,00ff,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,c09c,c09d,c09e,c09f,c0a0,c0a1,c0a2,c0a3,c0ac,c0ad,c0ae,c0af,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,002b,002d,0031,0033_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602`
JA4_o (sample)	`t13d4312h1_b7bf452c9920_cad92ccb4254`
JA4_ro (sample)	`t13d4312h1_1302,1303,1301,c02c,c030,c02b,c02f,cca9,cca8,009f,009e,ccaa,c0af,c0ad,c0ae,c0ac,c024,c028,c023,c027,c00a,c014,c009,c013,c0a3,c09f,c0a2,c09e,006b,0067,0039,0033,009d,009c,c0a1,c09d,c0a0,c09c,003d,003c,0035,002f,00ff_0000,000b,000a,0010,0016,0017,0031,000d,002b,002d,0033,0015_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn050000_b223a0ebb0b5_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.	289
`ge11nn070000_d53668ba0abf_000000000000_000000000000`	22
`he11nn06ja00_fb4afd1f380a_000000000000_000000000000`	17
`ge11nn06ja00_fb4afd1f380a_000000000000_000000000000`	17
`po11nn090000_f7d626a8a3c6_000000000000_000000000000`	11
`po11nn090000_c726d1eba7fe_000000000000_000000000000`	11
`ge11nn040000_608e01151bf4_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.	8
`ge11nn060000_133cb2a8d257_000000000000_000000000000`	8
`ge11nn100000_e71ef03ecdc1_000000000000_000000000000`	6
`ge11nn060000_2adaa72bf20c_000000000000_000000000000`	6

TCP SYN (p0f)

fingerprint	co-occurrences
`4:49+15:0:1400:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	108
`4:49+15:0:1400:mss*20,7:mss,sok,ts,nop,ws:df,id+:0`	48
`4:58+6:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:0`	35
`4:48+16:0:1400:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	18
`4:52+12:0:1400:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	16
`6:234+21:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0`	14
`4:48+16:0:1400:mss*20,7:mss,sok,ts,nop,ws:df,id+:0`	11
`4:51+13:0:1400:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	10
`6:46+18:0:1380:mss*47,7:mss,sok,ts,nop,ws:flow:0`	10
`4:56+8:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0`	8

TCP SYN (JA4T)

fingerprint	co-occurrences
`64240_2-4-8-1-3_1400_7`	160
`29200_2-4-8-1-3_1400_7`	72
`65320_2-4-8-1-3_1420_7`	35
`62727_2-4-8-1-3_1460_7`	19
`64800_2-4-8-1-3_1440_7`	16
`64860_2-4-8-1-3_1380_7`	10
`24320_2-4-8-1-3_1220_7`	8
`24704_2-4-8-1-3_1240_7`	8
`64240_2-4-8-1-3_1380_7`	6
`65535_2-4-8-1-3_1460_6`	6

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0`	232
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36`	32
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36`	21
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36`	13
`Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1`	8
`Mozilla/5.0 (Android 10; Mobile; rv:109.0) Gecko/118.0 Firefox/118.0`	8
`Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/118.1 Mobile/15E148 Safari/605.1.15`	8
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36`	8
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36`	7
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36`	6

Country

fingerprint	co-occurrences
`CN` · China	233
`US` · United States	48
`JP` · Japan	39
`IN` · India	7
`FI` · Finland	7
`AU` · Australia	6
`DE` · Germany	6
`TW` · Taiwan	6
`BR` · Brazil	5
`GB` · United Kingdom	5

Network (ASN)

fingerprint	co-occurrences
`AS4837` · CHINA UNICOM China169 Backbone	103
`AS4134` · CHINANET BACKBONE	102
`AS396982` · Google LLC	57
`AS16509` · Amazon.com, Inc.	29
`AS2516` · KDDI CORPORATION	19
`AS9605` · NTT DOCOMO, INC.	15
`AS14618` · Amazon.com, Inc.	12
`AS17638` · ASN for TIANJIN Provincial Net of CT	7
`AS140061` · Qinghai Telecom	7
`AS17622` · China Unicom Guangzhou network	6