TLS ClientHello (JA4)

t12d860600_e18388e7f3a3_a1e935682795

first seen 2026-06-11 00:53 · last seen 2026-09-15 23:25 · JSON

Last 7 days (7 observations)

Distinct clients per day (last 30 days, peak 3/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocol	`t (TLS over TCP)`
TLS version	`12`
SNI	`d (domain)`
Cipher count	`86`
Extension count	`6`
ALPN	`00`
Ciphers	0004, 0005, 0007, 000a, 000d, 0010, 0013, 0016, 002f, 0030, 0031, 0032, 0033, 0035, 0036, 0037, 0038, 0039, 003c, 003d, 003e, 003f, 0040, 0041, 0042, 0043, 0044, 0045, 0067, 0068, 0069, 006a, 006b, 0084, 0085, 0086, 0087, 0088, 0096, 0097, 0098, 0099, 009a, 009c, 009d, 009e, 009f, 00a0, 00a1, 00a2, 00a3, 00a4, 00a5, 00ff, c002, c003, c004, c005, c007, c008, c009, c00a, c00c, c00d, c00e, c00f, c011, c012, c013, c014, c023, c024, c025, c026, c027, c028, c029, c02a, c02b, c02c, c02d, c02e, c02f, c030, c031, c032
Extensions	`000a, 000b, 000d, 000f, 0023`
Signature algorithms	`0601, 0602, 0603, 0501, 0502, 0503, 0401, 0402, 0403, 0301, 0302, 0303, 0201, 0202, 0203`
JA4_r	t12d860600_0004,0005,0007,000a,000d,0010,0013,0016,002f,0030,0031,0032,0033,0035,0036,0037,0038,0039,003c,003d,003e,003f,0040,0041,0042,0043,0044,0045,0067,0068,0069,006a,006b,0084,0085,0086,0087,0088,0096,0097,0098,0099,009a,009c,009d,009e,009f,00a0,00a1,00a2,00a3,00a4,00a5,00ff,c002,c003,c004,c005,c007,c008,c009,c00a,c00c,c00d,c00e,c00f,c011,c012,c013,c014,c023,c024,c025,c026,c027,c028,c029,c02a,c02b,c02c,c02d,c02e,c02f,c030,c031,c032_000a,000b,000d,000f,0023_0601,0602,0603,0501,0502,0503,0401,0402,0403,0301,0302,0303,0201,0202,0203
JA4_o (sample)	`t12d860600_0719af303b3e_0ca94ab2d640`
JA4_ro (sample)	t12d860600_c030,c02c,c028,c024,c014,c00a,00a5,00a3,00a1,009f,006b,006a,0069,0068,0039,0038,0037,0036,0088,0087,0086,0085,c032,c02e,c02a,c026,c00f,c005,009d,003d,0035,0084,c02f,c02b,c027,c023,c013,c009,00a4,00a2,00a0,009e,0067,0040,003f,003e,0033,0032,0031,0030,009a,0099,0098,0097,0045,0044,0043,0042,c031,c02d,c029,c025,c00e,c004,009c,003c,002f,0096,0041,0007,c011,c007,c00c,c002,0005,0004,c012,c008,0016,0013,0010,000d,c00d,c003,000a,00ff_0000,000b,000a,0023,000d,000f_0601,0602,0603,0501,0502,0503,0401,0402,0403,0301,0302,0303,0201,0202,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn06enus_ff6fe191b79d_000000000000_000000000000`	46
`ge11nn05enus_a1be516b8e6e_000000000000_000000000000`	24
`ge10nr030000_341eb0d8946c_000000000000_000000000000`	4
`ge11nn06enus_39052e5ba942_000000000000_000000000000`	2
`ge11nn05enus_dff23709e538_000000000000_000000000000`	2
`ge11nn06en00_95798fa45f7f_000000000000_000000000000`	2
`ge11cr05en00_7dad6abb6231_dea264686b17_d2d2eccea75d`	1
`ge11cr05en00_7dad6abb6231_ce5c137e8db2_fcdfe9e659ff`	1
`ge10nr040000_c411b49e72b8_000000000000_000000000000`	1
`ge11cr06en00_95798fa45f7f_26917d39e6bd_cf2e234893b1`	1

TCP SYN (p0f)

fingerprint	co-occurrences
`4:122+6:0:1420:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	13
`4:114+14:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	9
`4:54+10:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:0`	7
`4:121+7:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	7
`4:45+19:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:0`	6
`4:40+24:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	4
`4:113+15:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	4
`4:117+11:0:1420:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	4
`4:44+20:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:0`	4
`4:112+16:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0`	3

TCP SYN (JA4T)

fingerprint	co-occurrences
`64240_2-1-3-1-1-4_1460_8`	18
`65170_2-4-8-1-3_1330_10`	17
`65320_2-1-3-1-1-4_1420_8`	13
`8192_2-1-3-1-1-4_1420_8`	3
`65280_2-1-3-1-1-4_1360_8`	1
`65535_2-1-3-1-1-4_1352_8`	1

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`	41
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`	16
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36`	11
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36`	9
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 CCleaner/130.0.0.0`	2
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36`	2
`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`	2
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36`	1
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36`	1
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36`	1

Country

fingerprint	co-occurrences
`NL` · Netherlands	18
`SG` · Singapore	16
`FR` · France	16
`US` · United States	13
`BE` · Belgium	8
`DE` · Germany	7
`RO` · Romania	2
`LT` · Lithuania	2
`JP` · Japan	1
`BG` · Bulgaria	1

Network (ASN)

fingerprint	co-occurrences
`AS396982` · Google LLC	22
`AS210558` · 1337 Services GmbH	16
`AS14061` · DigitalOcean, LLC	15
`AS9009` · M247 Europe SRL	10
`AS25369` · Hydra Communications Ltd	7
`AS213790` · Limited Network LTD	3
`AS204428` · SS-Net	2
`AS63949` · Akamai Connected Cloud	1
`AS16509` · Amazon.com, Inc.	1
`AS45102` · Alibaba (US) Technology Co., Ltd.	1