TLS ClientHello (JA4)

t13d1312h2_a44d0ee8b3cc_e381dae6da6b

first seen 2026-06-18 07:24 · last seen 2026-11-01 03:40 · JSON

Last 7 days (8 observations)

Distinct clients per day (last 30 days, peak 7/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count13
Extension count12
ALPNh2
Ciphers000a, 002f, 0035, 009c, 009d, 1301, 1302, 1303, c013, c02b, c02c, c02f, c030
Extensions000a, 000b, 000d, 0015, 0017, 0023, 002b, 002d, 0033, ff01
Signature algorithms0904, 0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601, 0201, 0603
JA4_rt13d1312h2_000a,002f,0035,009c,009d,1301,1302,1303,c013,c02b,c02c,c02f,c030_000a,000b,000d,0015,0017,0023,002b,002d,0033,ff01_0904,0403,0804,0401,0503,0805,0501,0806,0601,0201,0603
JA4_o (sample)t13d1312h2_11a1eeccea26_d699d1290f9d
JA4_ro (sample)t13d1312h2_1301,1302,1303,c02b,c02c,c02f,c030,c013,009c,009d,002f,0035,000a_0000,0017,ff01,000a,000b,0023,0010,000d,0033,002d,002b,0015_0904,0403,0804,0401,0503,0805,0501,0806,0601,0201,0603

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn090000_6c95df8859bf_000000000000_00000000000032
ge20nn090000_2b87eda31960_000000000000_00000000000026
ge20nn080000_3b4736f856c0_000000000000_00000000000019
ge20nn18enus_f19a7ce03b58_000000000000_00000000000010
ge20nn080000_eab49c6106e6_000000000000_0000000000008
ge20nn19enus_6d96c1a2ad8a_000000000000_0000000000007
ge20nn11enus_3e96b3a49e4b_000000000000_0000000000006
ge20nr21engb_dbadf4a3aba3_000000000000_0000000000005
ge20nn070000_1c05be67a921_000000000000_0000000000004
ge20nn100000_806fbb41f745_000000000000_0000000000004

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;3:1;4:8388608;5:65536|8323073|0|m,s,a,p153

TCP SYN (p0f)

fingerprintco-occurrences
4:55+9:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:040
4:52+12:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:032
4:51+13:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:017
4:54+10:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:013
4:50+14:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:012
4:49+15:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:010
4:53+11:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:09
4:47+17:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:09
4:56+8:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:08
4:48+16:0:1460:65535,13:mss,sok,ts,nop,ws:df,id+:02

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_1460_13139
65535_2-4-8-1-3_1360_131

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (compatible; SquareTownBot/1.0; +https://square.pov.town)34
Mozilla/5.0 (compatible; GCombinator/1.0; +https://news.gcombinator.com)20
Mozilla/5.0 (compatible; HNBot/1.0)17
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.367
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.365
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.364
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.364
Mozilla/5.0 (compatible; bot/1.0)4
Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.03
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)3

Country

fingerprintco-occurrences
US · United States55
SG · Singapore39
AU · Australia14
DE · Germany10
NL · Netherlands9
FR · France7
IN · India4
DK · Denmark4
BR · Brazil2
GB · United Kingdom2

Network (ASN)

fingerprintco-occurrences
AS13335 · Cloudflare, Inc.153

TLS supported groups

fingerprintco-occurrences
001d,0017,0018,0019,11ec,6399,fe3220