TLS ClientHello (JA4)

t13d5212h1_b262b3658495_8e6e362c5eac

first seen 2026-06-12 07:20 · last seen 2026-11-01 06:10 · JSON

Last 7 days (38 observations)

Distinct clients per day (last 30 days, peak 5/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count52
Extension count12
ALPNh1
Ciphers002f, 0032, 0033, 0035, 0038, 0039, 003c, 003d, 0040, 0067, 006a, 006b, 009c, 009d, 009e, 009f, 00a2, 00a3, 1301, 1302, 1303, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, c050, c051, c052, c053, c056, c057, c05c, c05d, c060, c061, c09c, c09d, c09e, c09f, c0ac, c0ad, cca8, cca9, ccaa
Extensions000a, 000b, 000d, 0016, 0017, 0023, 002b, 002d, 0033, ff01
Signature algorithms0905, 0906, 0904, 0403, 0503, 0603, 0807, 0808, 081a, 081b, 081c, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0301, 0302, 0402, 0502, 0602
JA4_rt13d5212h1_002f,0032,0033,0035,0038,0039,003c,003d,0040,0067,006a,006b,009c,009d,009e,009f,00a2,00a3,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,c050,c051,c052,c053,c056,c057,c05c,c05d,c060,c061,c09c,c09d,c09e,c09f,c0ac,c0ad,cca8,cca9,ccaa_000a,000b,000d,0016,0017,0023,002b,002d,0033,ff01_0905,0906,0904,0403,0503,0603,0807,0808,081a,081b,081c,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602
JA4_o (sample)t13d5212h1_ca35c0050d43_ec3b10441c8f
JA4_ro (sample)t13d5212h1_1302,1303,1301,c02f,c02b,c030,c02c,009e,c027,0067,c028,006b,00a3,009f,cca9,cca8,ccaa,c0ad,c09f,c05d,c061,c057,c053,00a2,c0ac,c09e,c05c,c060,c056,c052,c024,006a,c023,0040,c00a,c014,0039,0038,c009,c013,0033,0032,009d,c09d,c051,009c,c09c,c050,003d,003c,0035,002f_ff01,0000,000b,000a,0023,0010,0016,0017,000d,002b,002d,0033_0905,0906,0904,0403,0503,0603,0807,0808,081a,081b,081c,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn07*000_2f91038604b7_000000000000_00000000000036
ge11nn07*000_4ae0f4a72b53_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 24.21.0, node-fetch 24.19.0, node-fetch 24.22.1, +7 more.The fingerprint page shows the full measured match list. More on the catalog.19
ge11nn07*000_131b6413da1e_000000000000_00000000000018
ge11nn08*000_2025024c020c_000000000000_00000000000011
ge20nn05*000_754588453448_000000000000_00000000000011
ge11nn040000_08e7224bf8c7_000000000000_0000000000009
ge11nn07*000_3022bbb03f71_000000000000_0000000000009
ge11nn07*000_fd87022947da_000000000000_0000000000007
ge11nn07enus_6c5989145a61_000000000000_0000000000006
ge11nn12enus_c0f67fd42004_000000000000_0000000000006

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:262144|458753|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 26.13.0, node-fetch 26.4.0.The fingerprint page shows the full measured match list. More on the catalog.26

TCP SYN (p0f)

fingerprintco-occurrences
4:119+9:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:019
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:016
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:013
4:42+22:0:1410:mss*46,7:mss,sok,ts,nop,ws:df,id+:012
4:117+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:06
4:58+6:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:06
4:57+7:0:1276:mss*34,12:mss,sok,ts,nop,ws:df,id+:06
4:56+8:0:1460:65535,10:mss,sok,ts,nop,ws:df,id+:04
4:46+18:0:1440:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:04
4:43+21:0:1280:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:04

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_750
65535_2-1-3-1-1-4_1460_821
64860_2-4-8-1-3_1410_712
65535_2-1-3-1-1-8-4-0-0_1440_612
65535_2-4-8-1-3_1460_1010
65535_2-1-3-1-1-8-4-0-0_1460_67
43384_2-4-8-1-3_1276_127
65320_2-4-8-1-3_1420_76
64800_2-4-8-1-3_1440_76
65535_2-1-3-1-1-8-4-0-0_1280_66

User-Agent

fingerprintco-occurrences
node33
Mozilla/5.0 (compatible; QlyzeBot/1.0; +https://app.qlyze.io/bot)27
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.3614
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; BuiltWith/1.4; rb.gy/xprgqj) Chrome/124.0.0.0 Safari/537.3612
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.368
Mozilla/5.07
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.366
OpenAI File Downloader, XaiImageApiFetch/1.06
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.365
deepseek-harness/0.0.1 (+https://github.com/deepseek-ai)5

Country

fingerprintco-occurrences
US · United States57
DE · Germany56
HK · Hong Kong SAR China26
AU · Australia8
CN · China7
NL · Netherlands6
FR · France5
IN · India5
CA · Canada4
VN · Vietnam4

Network (ASN)

fingerprintco-occurrences
AS24940 · Hetzner Online GmbH45
AS9269 · Hong Kong Broadband Network Ltd.19
AS16509 · Amazon.com, Inc.17
AS8075 · Microsoft Corporation8
AS7545 · TPG Telecom Limited8
AS14061 · DigitalOcean, LLC6
AS396982 · Google LLC5
AS137816 · Cloud Net Technologies Limited5
AS7552 · Viettel Group4
AS15169 · Google LLC3

TLS supported groups

fingerprintco-occurrences
11ec,001d,0017,001e,0018,0019,0100,0101 Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1, python-requests 2.34.2, curl 8.23.0, +4 more.The fingerprint page shows the full measured match list. More on the catalog.87