TLS ClientHello (JA4)

t12d130600_2d7513195f68_e51b7354d87f

first seen 2026-06-11 12:07 · last seen 2026-10-31 04:03 · JSON

Last 7 days (9 observations)

Distinct clients per day (last 30 days, peak 5/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version12
SNId (domain)
Cipher count13
Extension count6
ALPN00
Ciphers0005, 000a, 002f, 0035, c007, c009, c00a, c011, c012, c013, c014, c02b, c02f
Extensions0005, 000a, 000b, 000d, ff01
Signature algorithms0401, 0403, 0201, 0203, 0401, 0501, 0601
JA4_rt12d130600_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601
JA4_o (sample)t12d130600_34ca9fd7c513_a6ad5fe9ef24
JA4_ro (sample)t12d130600_c02f,c02b,c011,c007,c013,c009,c014,c00a,0005,002f,0035,c012,000a_0000,0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nr040000_e1d2031bdfea_000000000000_000000000000263
ge11nn040000_88d30a62b7ad_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog.58
ge11nr040000_88d30a62b7ad_000000000000_00000000000026
ge11nr050000_57c5e92682a8_000000000000_0000000000007
ge11nn050000_57c5e92682a8_000000000000_0000000000006
ge11nn040000_e1d2031bdfea_000000000000_0000000000005
ge11nr05engb_f3bb7aa45ec4_000000000000_0000000000005
ge11nr05engb_813e32c09d15_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
6:53+11:0:1440:mss*30,9:mss,nop,ws:flow:079
6:51+13:0:1400:mss*45,7:mss,sok,ts,nop,ws:flow:060
4:51+13:0:1460:mss*29,9:mss,nop,ws:df,id+:050
4:53+11:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:026
6:47+17:0:1400:mss*45,7:mss,sok,ts,nop,ws:flow:019
4:46+18:0:1460:mss*29,9:mss,nop,ws:df,id+:011
6:50+14:0:1400:mss*45,7:mss,sok,ts,nop,ws:flow:011
4:52+12:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:011
4:55+9:0:1360:mss*48,7:mss,sok,ts,nop,ws:df,id+:09
4:45+19:0:1460:mss*29,9:mss,nop,ws:df,id+:08

TCP SYN (JA4T)

fingerprintco-occurrences
64800_2-4-8-1-3_1400_788
43200_2-1-3_1440_979
29200_2-4-8-1-3_1460_742
42340_2-1-3_1460_924
64240_2-4-8-1-3_1460_714
42340_2-4-8-1-3_1460_1312
65280_2-4-8-1-3_1360_711
42340_2-1-1-4-1-3_1460_118
64240_2-4-8-1-3_1440_73
64800_2-4-8-1-3_1440_72

User-Agent

fingerprintco-occurrences
Mozilla/5.0 zgrab/0.x118
Mozilla/5.0 (Linux; Android 11; M2004J15SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.3652
Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.368
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.06
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.366
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.365
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.04
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.364
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.363
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.363

Country

fingerprintco-occurrences
US · United States338
LT · Lithuania11
MN · Mongolia8
RO · Romania7
FR · France2
DE · Germany1
SG · Singapore1
CA · Canada1
GB · United Kingdom1
FI · Finland1

Network (ASN)

fingerprintco-occurrences
AS6939 · Hurricane Electric LLC159
AS8075 · Microsoft Corporation105
AS45102 · Alibaba (US) Technology Co., Ltd.52
AS36352 · HostPapa12
AS213790 · Limited Network LTD11
AS45204 · GEMNET LLC8
AS47890 · UNMANAGED LTD7
AS402226 · OnlyScans LLC5
AS14061 · DigitalOcean, LLC4
AS22168 · The Shadowserver Foundation, Inc.3

TLS supported groups

fingerprintco-occurrences
0017,0018,001928