TLS ClientHello (JA4)

t12d860600_e18388e7f3a3_a1e935682795

first seen 2026-06-11 00:53 · last seen 2026-10-31 17:38 · JSON

Last 7 days (3 observations)

Distinct clients per day (last 30 days, peak 2/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version12
SNId (domain)
Cipher count86
Extension count6
ALPN00
Ciphers0004, 0005, 0007, 000a, 000d, 0010, 0013, 0016, 002f, 0030, 0031, 0032, 0033, 0035, 0036, 0037, 0038, 0039, 003c, 003d, 003e, 003f, 0040, 0041, 0042, 0043, 0044, 0045, 0067, 0068, 0069, 006a, 006b, 0084, 0085, 0086, 0087, 0088, 0096, 0097, 0098, 0099, 009a, 009c, 009d, 009e, 009f, 00a0, 00a1, 00a2, 00a3, 00a4, 00a5, 00ff, c002, c003, c004, c005, c007, c008, c009, c00a, c00c, c00d, c00e, c00f, c011, c012, c013, c014, c023, c024, c025, c026, c027, c028, c029, c02a, c02b, c02c, c02d, c02e, c02f, c030, c031, c032
Extensions000a, 000b, 000d, 000f, 0023
Signature algorithms0601, 0602, 0603, 0501, 0502, 0503, 0401, 0402, 0403, 0301, 0302, 0303, 0201, 0202, 0203
JA4_rt12d860600_0004,0005,0007,000a,000d,0010,0013,0016,002f,0030,0031,0032,0033,0035,0036,0037,0038,0039,003c,003d,003e,003f,0040,0041,0042,0043,0044,0045,0067,0068,0069,006a,006b,0084,0085,0086,0087,0088,0096,0097,0098,0099,009a,009c,009d,009e,009f,00a0,00a1,00a2,00a3,00a4,00a5,00ff,c002,c003,c004,c005,c007,c008,c009,c00a,c00c,c00d,c00e,c00f,c011,c012,c013,c014,c023,c024,c025,c026,c027,c028,c029,c02a,c02b,c02c,c02d,c02e,c02f,c030,c031,c032_000a,000b,000d,000f,0023_0601,0602,0603,0501,0502,0503,0401,0402,0403,0301,0302,0303,0201,0202,0203
JA4_o (sample)t12d860600_0719af303b3e_0ca94ab2d640
JA4_ro (sample)t12d860600_c030,c02c,c028,c024,c014,c00a,00a5,00a3,00a1,009f,006b,006a,0069,0068,0039,0038,0037,0036,0088,0087,0086,0085,c032,c02e,c02a,c026,c00f,c005,009d,003d,0035,0084,c02f,c02b,c027,c023,c013,c009,00a4,00a2,00a0,009e,0067,0040,003f,003e,0033,0032,0031,0030,009a,0099,0098,0097,0045,0044,0043,0042,c031,c02d,c029,c025,c00e,c004,009c,003c,002f,0096,0041,0007,c011,c007,c00c,c002,0005,0004,c012,c008,0016,0013,0010,000d,c00d,c003,000a,00ff_0000,000b,000a,0023,000d,000f_0601,0602,0603,0501,0502,0503,0401,0402,0403,0301,0302,0303,0201,0202,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn06enus_ff6fe191b79d_000000000000_00000000000076
ge11nn05enus_a1be516b8e6e_000000000000_00000000000024
ge10nr030000_341eb0d8946c_000000000000_0000000000004
ge11nn06en00_95798fa45f7f_000000000000_0000000000003
ge11nn06enus_39052e5ba942_000000000000_0000000000002
ge11nn05enus_dff23709e538_000000000000_0000000000002
ge11cr05en00_7dad6abb6231_dea264686b17_d2d2eccea75d1
ge11cr05en00_7dad6abb6231_ce5c137e8db2_fcdfe9e659ff1
ge10nr040000_c411b49e72b8_000000000000_0000000000001
ge11cr06en00_95798fa45f7f_26917d39e6bd_cf2e234893b11

TCP SYN (p0f)

fingerprintco-occurrences
4:122+6:0:1420:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:017
4:44+20:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:013
4:45+19:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:010
4:114+14:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:09
4:54+10:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:09
4:121+7:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:07
4:112+16:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:05
4:40+24:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:04
4:113+15:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:04
4:117+11:0:1420:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:04

TCP SYN (JA4T)

fingerprintco-occurrences
65170_2-4-8-1-3_1330_1035
64240_2-1-3-1-1-4_1460_822
65320_2-1-3-1-1-4_1420_817
65280_2-1-3-1-1-4_1360_84
8192_2-1-3-1-1-4_1420_83
64240_2-4-8-1-3_1460_101
65535_2-1-3-1-1-4_1460_81
65535_2-1-3-1-1-4_1440_81
65535_2-1-3-1-1-4_1352_81

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.3662
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.3620
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.3613
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3611
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.364
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 CCleaner/130.0.0.02
Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.12
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.361

Country

fingerprintco-occurrences
FR · France32
NL · Netherlands19
SG · Singapore19
US · United States17
DE · Germany9
BE · Belgium8
IN · India3
SI · Slovenia3
RO · Romania2
LT · Lithuania2

Network (ASN)

fingerprintco-occurrences
AS396982 · Google LLC26
AS9009 · M247 Europe SRL23
AS14061 · DigitalOcean, LLC19
AS210558 · 1337 Services GmbH16
AS25369 · Hydra Communications Ltd9
AS213790 · Limited Network LTD3
AS60068 · Datacamp Limited3
AS197769 · VPS Dedicated LLC3
AS212238 · Datacamp Limited2
AS204428 · SS-Net2

TLS supported groups

fingerprintco-occurrences
0017,0019,001c,001b,0018,001a,0016,000e,000d,000b,000c,0009,000a5