TLS ClientHello (JA4)

t13d3112h2_e8f1e7e78f70_8d633dac7124

first seen 2026-06-17 17:47 · last seen 2026-09-16 04:23 · JSON

Last 7 days (24 observations)

Distinct clients per day (last 30 days, peak 11/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count31
Extension count12
ALPNh2
Ciphers002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, 00ff, 1301, 1302, 1303, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, cca8, cca9, ccaa
Extensions000a, 000b, 000d, 0015, 0016, 0017, 002b, 002d, 0031, 0033
Signature algorithms0403, 0503, 0603, 0807, 0808, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0203, 0301, 0201, 0302, 0202, 0402, 0502, 0602
JA4_rt13d3112h2_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,00ff,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,002b,002d,0031,0033_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0203,0301,0201,0302,0202,0402,0502,0602
JA4_o (sample)t13d3112h2_d7c3e2abb617_5a3233f87c29
JA4_ro (sample)t13d3112h2_1302,1303,1301,c02c,c030,009f,cca9,cca8,ccaa,c02b,c02f,009e,c024,c028,006b,c023,c027,0067,c00a,c014,0039,c009,c013,0033,009d,009c,003d,003c,0035,002f,00ff_0000,000b,000a,0010,0016,0017,0031,000d,002b,002d,0033,0015_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0203,0301,0201,0302,0202,0402,0502,0602

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn040000_b221e026a664_000000000000_00000000000091
ge20nn050000_95d177640a65_000000000000_00000000000024
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.18.0, +9 more.The fingerprint page shows the full measured match list. More on the catalog.11
ge20nn040000_31537f9be9e0_000000000000_00000000000010
ge20nn030000_042112399351_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0.The fingerprint page shows the full measured match list. More on the catalog.1
he20nn020000_5594a17e7e7e_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
3:100;4:65536;2:0|1048510465|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +7 more.The fingerprint page shows the full measured match list. More on the catalog.126
3:100;4:10485760;2:0|1048510465|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0.The fingerprint page shows the full measured match list. More on the catalog.10
3:100;4:33554432;2:0|33488897|0|m,p,s,a Match?Exact match in Thumbprint's published controlled catalog captures: php-curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.2

TCP SYN (p0f)

fingerprintco-occurrences
4:45+19:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::029
4:41+23:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::013
4:40+24:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::012
4:47+17:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop:ecn:011
4:39+25:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::011
4:44+20:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::09
4:43+21:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop::08
4:42+22:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop:ecn:08
4:48+16:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop:ecn:04
4:46+18:0:1410:mss*30,8:mss,sok,ts,nop,ws,?34,nop,nop:ecn:04

TCP SYN (JA4T)

fingerprintco-occurrences
42300_2-4-8-1-3-34-1-1_1410_8100
64800_2-4-8-1-3_1440_78
29200_2-4-8-1-3_1460_72
65535_2-1-3-1-1-8-4-0-0_1460_61
42300_2-4-8-1-3-254_1410_81
64240_2-4-8-1-3_1396_41

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)121
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.09
Mozilla/5.0 (compatible; YandexFavicons/1.0; +http://yandex.com/bots)4
SynologyChatBot/1.02
curl/8.1.11
curl/8.12.11

Country

fingerprintco-occurrences
RU · Russia90
TR · Turkey23
KZ · Kazakhstan12
US · United States10
KR · South Korea3

Network (ASN)

fingerprintco-occurrences
AS13238 · YANDEX LLC90
AS212066 · Buyuk Reklam Cozumleri LLC23
AS207304 · Y. Izdeu men Jarnama LLP12
AS63949 · Akamai Connected Cloud9
AS9318 · SK Broadband Co Ltd2
AS4766 · Korea Telecom1
AS21928 · T-Mobile USA, Inc.1