TLS ClientHello (JA4)

t13d131300_f57a46bbacb6_1bd98dace775

first seen 2026-06-18 02:00 · last seen 2026-09-14 05:16 · JSON

Last 7 days (118 observations)

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count13
Extension count13
ALPN00
Ciphers1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 0023, 002b, 002d, 0032, 0033, ff01
Signature algorithms0804, 0403, 0807, 0805, 0806, 0401, 0501, 0601, 0503, 0603, 0201, 0203
JA4_rt13d131300_1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,0023,002b,002d,0032,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203
JA4_o (sample)t13d131300_45672f90a73c_2bd48c8a99cb
JA4_ro (sample)t13d131300_c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,1301,1302,1303_0000,000b,0023,ff01,0017,0012,0005,000a,000d,0032,002b,0033,002d_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nr05enus_f3bb7aa45ec4_000000000000_000000000000204
ge11nn05enus_f3bb7aa45ec4_000000000000_000000000000175
ge11nr040000_e1d2031bdfea_000000000000_00000000000020
ge11nn040000_e1d2031bdfea_000000000000_00000000000012
ge11nn040000_8391bea91fb6_000000000000_0000000000009
po11nn070000_4bdda3fbf555_000000000000_0000000000009
ge11nn050000_3658ef221638_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.21.3, wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog.6
op11nn040000_8391bea91fb6_000000000000_0000000000006
ge11nn030000_0db47b7d240d_000000000000_0000000000003
po11nn060000_ed383ed8462e_000000000000_0000000000003

TCP SYN (p0f)

fingerprintco-occurrences
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0409
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:08
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:08
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:08
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:05
4:58+6:0:1420:mss*31,9:mss,sok,ts,nop,ws:df,id+,ts2+:05
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:03
4:40+24:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:03
4:41+23:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:03
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02

TCP SYN (JA4T)

fingerprintco-occurrences
42600_2-4-8-1-3_1420_9409
64240_2-4-8-1-3_1460_730
43648_2-4-8-1-3_1420_95

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (l9scan/2.0.639313e2430313e22313e2839313; +https://leakix.net)24
Mozilla/5.0 (l9scan/2.0.430313e2739313e24393e23323; +https://leakix.net)10
Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)9
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)8
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot7
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)7
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)7
Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)7
Mozilla/5.0 (l9scan/2.0.8363e20373e23383e24363; +https://leakix.net)6
Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)5

Country

fingerprintco-occurrences
US · United States177
BE · Belgium125
TW · Taiwan118
SG · Singapore12
CA · Canada10
DE · Germany8
NL · Netherlands4

Network (ASN)

fingerprintco-occurrences
AS396982 · Google LLC414
AS14061 · DigitalOcean, LLC40