TLS ClientHello (JA4)

t12d130600_2d7513195f68_e51b7354d87f

first seen 2026-06-11 12:07 · last seen 2026-09-16 12:10 · JSON

Last 7 days (11 observations)

Distinct clients per day (last 30 days, peak 5/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocol	`t (TLS over TCP)`
TLS version	`12`
SNI	`d (domain)`
Cipher count	`13`
Extension count	`6`
ALPN	`00`
Ciphers	`0005, 000a, 002f, 0035, c007, c009, c00a, c011, c012, c013, c014, c02b, c02f`
Extensions	`0005, 000a, 000b, 000d, ff01`
Signature algorithms	`0401, 0403, 0201, 0203, 0401, 0501, 0601`
JA4_r	`t12d130600_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601`
JA4_o (sample)	`t12d130600_34ca9fd7c513_a6ad5fe9ef24`
JA4_ro (sample)	`t12d130600_c02f,c02b,c011,c007,c013,c009,c014,c00a,0005,002f,0035,c012,000a_0000,0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nr040000_e1d2031bdfea_000000000000_000000000000`	194
`ge11nn040000_88d30a62b7ad_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog.	58
`ge11nr040000_88d30a62b7ad_000000000000_000000000000`	26
`ge11nr050000_57c5e92682a8_000000000000_000000000000`	5
`ge11nn050000_57c5e92682a8_000000000000_000000000000`	4
`ge11nn040000_e1d2031bdfea_000000000000_000000000000`	3
`ge11nr05engb_f3bb7aa45ec4_000000000000_000000000000`	3
`ge11nr05engb_813e32c09d15_000000000000_000000000000`	1

TCP SYN (p0f)

fingerprint	co-occurrences
`6:51+13:0:1400:mss*45,7:mss,sok,ts,nop,ws:flow:0`	60
`6:53+11:0:1440:mss*30,9:mss,nop,ws:flow:0`	52
`4:51+13:0:1460:mss*29,9:mss,nop,ws:df,id+:0`	50
`6:47+17:0:1400:mss*45,7:mss,sok,ts,nop,ws:flow:0`	19
`6:50+14:0:1400:mss*45,7:mss,sok,ts,nop,ws:flow:0`	11
`4:53+11:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0`	11
`4:55+9:0:1360:mss*48,7:mss,sok,ts,nop,ws:df,id+:0`	9
`4:45+19:0:1460:mss*29,9:mss,nop,ws:df,id+:0`	8
`4:41+23:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0`	7
`4:45+19:0:1440:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	6

TCP SYN (JA4T)

fingerprint	co-occurrences
`64800_2-4-8-1-3_1400_7`	88
`43200_2-1-3_1440_9`	52
`29200_2-4-8-1-3_1460_7`	19
`42340_2-1-3_1460_9`	14
`65280_2-4-8-1-3_1360_7`	10
`64240_2-4-8-1-3_1460_7`	9
`42340_2-4-8-1-3_1460_13`	8
`42340_2-1-1-4-1-3_1460_11`	4
`64240_2-4-8-1-3_1440_7`	3
`64800_2-4-8-1-3_1440_7`	1

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 zgrab/0.x`	115
`Mozilla/5.0 (Linux; Android 11; M2004J15SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.36`	29
`Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36`	5
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0`	4
`Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36`	4
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`	3
`Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0`	3
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0`	3
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36`	3
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36`	3

Country

fingerprint	co-occurrences
`US` · United States	269
`LT` · Lithuania	10
`RO` · Romania	5
`MN` · Mongolia	4
`FR` · France	2
`DE` · Germany	1
`SG` · Singapore	1
`CA` · Canada	1
`FI` · Finland	1

Network (ASN)

fingerprint	co-occurrences
`AS6939` · Hurricane Electric LLC	125
`AS8075` · Microsoft Corporation	105
`AS45102` · Alibaba (US) Technology Co., Ltd.	29
`AS213790` · Limited Network LTD	10
`AS36352` · HostPapa	8
`AS47890` · UNMANAGED LTD	5
`AS45204` · GEMNET LLC	4
`AS402226` · OnlyScans LLC	3
`AS14061` · DigitalOcean, LLC	2
`AS12876` · Scaleway SAS	2