TLS ClientHello (JA4)

t13d3612h1_018971650b2c_e8b3fe21f08b

first seen 2026-07-31 22:40 · last seen 2026-09-16 15:26 · JSON

Last 7 days (6 observations)

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count36
Extension count12
ALPNh1
Ciphers002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, 00ff, 1301, 1302, 1303, 1304, c009, c00a, c013, c014, c023, c027, c02b, c02c, c02f, c030, c09c, c09d, c09e, c09f, c0ac, c0ad, cca8, cca9, ccaa
Extensions000a, 000b, 000d, 0015, 0016, 0017, 0023, 002b, 002d, 0033
Signature algorithms0403, 0503, 0603, 0807, 0808, 0809, 0804, 080a, 0805, 080b, 0806, 0401, 0501, 0601, 0303, 0301, 0203, 0201
JA4_rt13d3612h1_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,00ff,1301,1302,1303,1304,c009,c00a,c013,c014,c023,c027,c02b,c02c,c02f,c030,c09c,c09d,c09e,c09f,c0ac,c0ad,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,0023,002b,002d,0033_0403,0503,0603,0807,0808,0809,0804,080a,0805,080b,0806,0401,0501,0601,0303,0301,0203,0201
JA4_o (sample)t13d3612h1_aa9a9650c48e_7e87463cdc17
JA4_ro (sample)t13d3612h1_1302,1303,1301,1304,c02c,c030,cca9,cca8,c0ad,c02b,c02f,c0ac,c023,c027,c00a,c014,c009,c013,009d,c09d,009c,c09c,003d,003c,0035,002f,009f,ccaa,c09f,009e,c09e,006b,0067,0039,0033,00ff_0000,000b,000a,0023,0010,0016,0017,000d,002b,002d,0033,0015_0403,0503,0603,0807,0808,0809,0804,080a,0805,080b,0806,0401,0501,0601,0303,0301,0203,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn050000_3658ef221638_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.21.3, wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog.31

TCP SYN (p0f)

fingerprintco-occurrences
4:46+18:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:015
4:47+17:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:08
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
4:46+18:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:01
4:44+20:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:01
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:01
4:41+23:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:01
4:43+21:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:01
4:54+10:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:01
4:55+9:0:1412:mss*44,7:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_1460_923
65535_2-4-8-1-3_1460_62
65535_2-4-8-1-3_1400_62
64240_2-4-8-1-3_1460_71
64240_2-4-8-1-3_1412_71
65535_2-4-8-1-3_1412_61
65535_2-4-8-1-3_1452_61

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3631

Country

fingerprintco-occurrences
HK · Hong Kong SAR China23
AR · Argentina2
PY · Paraguay1
MX · Mexico1
FR · France1
ZA · South Africa1
BD · Bangladesh1
IQ · Iraq1

Network (ASN)

fingerprintco-occurrences
AS45102 · Alibaba (US) Technology Co., Ltd.23
AS11664 · Techtel LMDS Comunicaciones Interactivas S.A.1
AS15557 · Societe Francaise Du Radiotelephone - SFR SA1
AS8151 · Uninet S.A. de C.V.1
AS63969 · Race Online Limited1
AS23201 · Telecel S.A.1
AS203214 · Hulum Almustakbal Company for Communication Engineering and Services Ltd1
AS37105 · RAIN GROUP HOLDINGS (PTY) LTD1
AS28048 · Internet Para Todos - Gobierno de La Rioja1