TLS ClientHello (JA4)

q13d0312h3_55b375c5d22e_5a06198afb93

first seen 2026-06-10 23:55 · last seen 2026-09-14 22:56 · JSON

Decomposed attributes

Protocolq (QUIC)
TLS version13
SNId (domain)
Cipher count3
Extension count12
ALPNh3
Ciphers1301, 1302, 1303
Extensions000a, 000d, 001b, 0029, 002b, 002d, 0033, 0039, 44cd, fe0d
Signature algorithms0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601, 0201
JA4_rq13d0312h3_1301,1302,1303_000a,000d,001b,0029,002b,002d,0033,0039,44cd,fe0d_0403,0804,0401,0503,0805,0501,0806,0601,0201
JA4_o (sample)q13d0312h3_55b375c5d22e_3df205359331
JA4_ro (sample)q13d0312h3_1301,1302,1303_000a,44cd,000d,002b,001b,0010,0033,0039,0000,fe0d,002d,0029_0403,0804,0401,0503,0805,0501,0806,0601,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge30nr14engb_186438911b7e_000000000000_000000000000119
ge30nr15engb_eb14703c0579_000000000000_00000000000051
ge30nr13engb_54728652be35_000000000000_00000000000051
ge30nr16engb_ce20326d9e21_000000000000_00000000000034
ge30nr14engb_b627e55c4c56_000000000000_00000000000014
ge30nn14engb_186438911b7e_000000000000_0000000000009
ge30nr15engb_cbb1aaa5e388_000000000000_0000000000006
ge30nn15zhcn_eb14703c0579_000000000000_0000000000005
ge30nn15engb_eb14703c0579_000000000000_0000000000005
ge30nr15enus_f16eb7f04942_000000000000_0000000000004

QUIC transport params

fingerprintco-occurrences
q14_3a9b21a290be279
q13_b3b195fe7bab Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, edge 151.0.4129.93, chrome 151.0.7922.170, +32 more.The fingerprint page shows the full measured match list. More on the catalog.43
q14_14f7d13e4d367
q13_313ab9afcaf5 Match?Exact match in Thumbprint's published controlled catalog captures: chromium 149.0.7827.102, chrome 149.0.7827.102, edge 149.0.4022.52, +6 more.The fingerprint page shows the full measured match list. More on the catalog.3
q12_2c26d7b310f13
q15_eaed878cc92c2
q13_dd17ae3ead6b2

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36283
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.3621
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.3613
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.365
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.365
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.364
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.362

Country

fingerprintco-occurrences
AU · Australia282
US · United States11
SE · Sweden9
CN · China9
PL · Poland6
EE · Estonia5
HR · Croatia3
CY · Cyprus3
DE · Germany2
UA · Ukraine2

Network (ASN)

fingerprintco-occurrences
AS38195 · Superloop282
AS4134 · CHINANET BACKBONE8
AS39351 · 31173 Services AB6
AS61307 · AS STV5
AS5617 · Orange Polska Spolka Akcyjna5
AS8075 · Microsoft Corporation4
AS44306 · OMONIA d.o.o.3
AS3301 · Telia Company AB3
AS35432 · Cablenet Communication Systems plc3
AS16276 · OVH SAS2

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
t13d1516h2_8daaf6152771_d8a2da3f94cd51
t13d1517h2_8daaf6152771_b6f405a006244