TLS ClientHello (JA4)

t13d1311h2_f57a46bbacb6_e7c285222651

first seen 2026-06-17 09:51 · last seen 2026-09-16 06:25 · JSON

Last 7 days (2 observations)

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count13
Extension count11
ALPNh2
Ciphers1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 002b, 0033, ff01
Signature algorithms0804, 0403, 0807, 0805, 0806, 0401, 0501, 0601, 0503, 0603, 0201, 0203
JA4_rt13d1311h2_1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203
JA4_o (sample)t13d1311h2_45672f90a73c_fe8fa1c5cc33
JA4_ro (sample)t13d1311h2_c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,1301,1302,1303_0000,000b,ff01,0017,0012,0005,000a,000d,0010,002b,0033_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn04enus_39a3ba4480e8_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2.The fingerprint page shows the full measured match list. More on the catalog.3
ge20nn020000_b89ce445e0b3_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.27.0, go-net/http 1.26.6, +10 more.The fingerprint page shows the full measured match list. More on the catalog.3
ge20nn030000_0db47b7d240d_000000000000_0000000000001
ge20nn030000_b74f9ffb1cea_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.23.12.The fingerprint page shows the full measured match list. More on the catalog.1
ge20nn030000_ff50983941c1_000000000000_0000000000001
ge20nr030000_ff50983941c1_000000000000_0000000000001
ge20nn05enus_eeed6042a2dd_000000000000_0000000000001
ge20nr08enus_b29e9d0b8340_000000000000_0000000000001
ge20nr08enus_1b4aa90a03cb_000000000000_0000000000001
ge20nr08enus_ec5f1fd6766c_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:4194304;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.23.12.The fingerprint page shows the full measured match list. More on the catalog.8
2:0;4:4194304;5:16384;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.8, go-net/http 1.26.7, +6 more.The fingerprint page shows the full measured match list. More on the catalog.7
2:0;4:4194304;5:1048576;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.0, go-net/http 1.27.1.The fingerprint page shows the full measured match list. More on the catalog.1

TCP SYN (p0f)

fingerprintco-occurrences
4:56+8:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:04
4:119+9:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:03
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
4:117+11:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:01
4:106+22:0:1452:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01
6:53+11:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:01
4:47+17:0:1400:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
4:49+15:0:1460:62727,10:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_77
62727_2-4-8-1-3_1460_73
64800_2-4-8-1-3_1440_71
64240_2-4-8-1-3_1400_71
62727_2-4-8-1-3_1460_101
64240_2-4-8-1-3_1460_91

User-Agent

fingerprintco-occurrences
Go-http-client/2.05
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.365
Mozilla/5.01
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.361

Country

fingerprintco-occurrences
US · United States8
NL · Netherlands3
CH · Switzerland1
ID · Indonesia1
IE · Ireland1
DK · Denmark1
PA · Panama1

Network (ASN)

fingerprintco-occurrences
AS16509 · Amazon.com, Inc.5
AS64107 · RACK SPHERE HOSTING S.A.4
AS63949 · Akamai Connected Cloud1
AS14618 · Amazon.com, Inc.1
AS36352 · HostPapa1
AS139981 · PT. Menaksopal Link Nusantara1
AS402253 · SKN Subnet & Telecom Ltd1
AS397006 · Mullcloud LLC1
AS204151 · EWII Bredbaand A/S1