TLS ClientHello (JA4)

t13d1314h2_f57a46bbacb6_14788d8d241b

first seen 2026-07-19 18:43 · last seen 2026-07-19 18:43 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count13
Extension count14
ALPNh2
Ciphers1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0015, 0017, 001b, 002b, 002d, 0033, ff01
Signature algorithms0403, 0804, 0401, 0503, 0203, 0805, 0805, 0501, 0806, 0601, 0201
JA4_rt13d1314h2_1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,002b,002d,0033,ff01_0403,0804,0401,0503,0203,0805,0805,0501,0806,0601,0201
JA4_o (sample)t13d1314h2_a6996a8865d9_65135c5c1a6b
JA4_ro (sample)t13d1314h2_1301,1302,1303,c02c,c02b,cca9,c030,c02f,cca8,c00a,c009,c014,c013_0000,0017,ff01,000a,000b,0010,0005,000d,0012,0033,002d,002b,001b,0015_0403,0804,0401,0503,0203,0805,0805,0501,0806,0601,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn020000_fb4f949fd323_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.9, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.1

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:4096;2:1;3:100;4:2097152;5:16384;6:4294967295|15663105|1:1:0:256|m,s,p,a1

TCP SYN (p0f)

fingerprintco-occurrences
4:52+12:0:1452:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:01

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-1-3-1-1-8-4-0-0_1452_61

User-Agent

fingerprintco-occurrences
avtocod/3 CFNetwork/3826.600.41 Darwin/24.6.01

Country

fingerprintco-occurrences
RU · Russia1

Network (ASN)

fingerprintco-occurrences
AS57378 · JSC ER-Telecom Holding1