TLS ClientHello (JA4)

t13d4312h1_c7886603b240_b26ce05bbdd6

first seen 2026-06-11 06:40 · last seen 2026-11-03 02:13 · JSON

Last 7 days (4842 observations)

Distinct clients per day (last 30 days, peak 2523/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count43
Extension count12
ALPNh1
Ciphers002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, 00ff, 1301, 1302, 1303, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, c09c, c09d, c09e, c09f, c0a0, c0a1, c0a2, c0a3, c0ac, c0ad, c0ae, c0af, cca8, cca9, ccaa
Extensions000a, 000b, 000d, 0015, 0016, 0017, 002b, 002d, 0031, 0033
Signature algorithms0403, 0503, 0603, 0807, 0808, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0301, 0302, 0402, 0502, 0602
JA4_rt13d4312h1_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,00ff,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,c09c,c09d,c09e,c09f,c0a0,c0a1,c0a2,c0a3,c0ac,c0ad,c0ae,c0af,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,002b,002d,0031,0033_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602
JA4_o (sample)t13d4312h1_b7bf452c9920_cad92ccb4254
JA4_ro (sample)t13d4312h1_1302,1303,1301,c02c,c030,c02b,c02f,cca9,cca8,009f,009e,ccaa,c0af,c0ad,c0ae,c0ac,c024,c028,c023,c027,c00a,c014,c009,c013,c0a3,c09f,c0a2,c09e,006b,0067,0039,0033,009d,009c,c0a1,c09d,c0a0,c09c,003d,003c,0035,002f,00ff_0000,000b,000a,0010,0016,0017,0031,000d,002b,002d,0033,0015_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn050000_b223a0ebb0b5_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.29057
ge11nn070000_d53668ba0abf_000000000000_00000000000034
po11nn090000_f7d626a8a3c6_000000000000_00000000000021
po11nn090000_c726d1eba7fe_000000000000_00000000000021
he11nn06ja00_fb4afd1f380a_000000000000_00000000000017
ge11nn06ja00_fb4afd1f380a_000000000000_00000000000017
ge11nn060000_2adaa72bf20c_000000000000_0000000000009
ge11nn040000_608e01151bf4_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.8
ge11nn060000_133cb2a8d257_000000000000_0000000000008
ge11nn100000_e71ef03ecdc1_000000000000_0000000000006

TCP SYN (p0f)

fingerprintco-occurrences
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0605
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0596
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0513
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0492
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0449
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0440
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0430
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0424
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0422
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0416

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_1460_64902
65535_2-4-8-1-3_1452_63140
64240_2-4-8-1-3_1460_72916
65535_2-4-8-1-3_1412_62707
65535_2-4-8-1-3_1440_62682
65535_2-4-8-1-3_1400_61686
64240_2-4-8-1-3_1452_71547
65535_2-4-8-1-3_1432_61436
65535_2-4-8-1-3_1392_6755
65535_2-4-8-1-3_1460_8435

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.365222
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.364921
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.364250
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.363418
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.362942
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.362228
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.361759
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.361426
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.361142
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36841

Country

fingerprintco-occurrences
US · United States4662
BR · Brazil2004
TR · Turkey1662
FR · France1641
ES · Spain1509
VN · Vietnam1323
GB · United Kingdom1179
CA · Canada984
BD · Bangladesh873
IT · Italy871

Network (ASN)

fingerprintco-occurrences
AS7922 · Comcast Cable Communications, LLC788
AS45899 · VNPT Corp574
AS9121 · Turk Telekomunikasyon Anonim Sirketi561
AS3215 · Orange S.A.507
AS7018 · AT&T Enterprises, LLC435
AS7552 · Viettel Group432
AS12322 · Free SAS380
AS15557 · Societe Francaise Du Radiotelephone - SFR SA347
AS5089 · Virgin Media Limited327
AS5410 · Bouygues Telecom SA316

TLS supported groups

fingerprintco-occurrences
001d,0017,001e,0019,0018,0100,0101,0102,0103,0104 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, php-guzzle 8.3.1, curl 7.88.1, +10 more.The fingerprint page shows the full measured match list. More on the catalog.21154
001d,0017,001e,0019,0018101