TLS ClientHello (JA4)

t13d311100_e8f1e7e78f70_d41ae481755e

first seen 2026-06-11 23:08 · last seen 2026-11-01 23:33 · JSON

Last 7 days (811 observations)

Distinct clients per day (last 30 days, peak 66/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count31
Extension count11
ALPN00
Ciphers002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, 00ff, 1301, 1302, 1303, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, cca8, cca9, ccaa
Extensions000a, 000b, 000d, 0015, 0016, 0017, 0023, 002b, 002d, 0033
Signature algorithms0403, 0503, 0603, 0807, 0808, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0301, 0302, 0402, 0502, 0602
JA4_rt13d311100_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,00ff,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,0023,002b,002d,0033_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602
JA4_o (sample)t13d311100_d7c3e2abb617_aaa1579dc5ae
JA4_ro (sample)t13d311100_1302,1303,1301,c02c,c030,009f,cca9,cca8,ccaa,c02b,c02f,009e,c024,c028,006b,c023,c027,0067,c00a,c014,0039,c009,c013,0033,009d,009c,003d,003c,0035,002f,00ff_0000,000b,000a,0023,0016,0017,000d,002b,002d,0033,0015_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nr040000_177aea7101ae_000000000000_0000000000004598
ge11nn050000_ea6f06182064_000000000000_00000000000021
ge11nn040000_e1d2031bdfea_000000000000_00000000000019
ge11nr07enus_1ce6da179c54_000000000000_00000000000012
ge11nn040000_5b1e8b5f4d2d_000000000000_00000000000010
ge11nn040000_08e7224bf8c7_000000000000_00000000000010
ge11nn16zhcn_35f56c33e338_000000000000_00000000000010
ge11nr040000_88d30a62b7ad_000000000000_0000000000007
ge11nn040000_88d30a62b7ad_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog.6
ge11nn05enus_f3bb7aa45ec4_000000000000_0000000000005

TCP SYN (p0f)

fingerprintco-occurrences
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:03513
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0389
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0382
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0195
4:45+19:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0117
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:016
4:45+19:0:1360:65535,9:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:010
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:07
6:50+14:0:1440:mss*45,9:mss,sok,ts,nop,ws:flow:07
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:06

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_74627
64240_2-4-8-1-3_1460_1011
64240_2-4-8-1-3_1460_910
65535_2-4-1-1-1-1-1-1-1-1-1-1-1-3_1360_910
64800_2-4-8-1-3_1440_78
64800_2-4-8-1-3_1440_97
42340_2-4-8-1-3_1410_107
64240_2-4-8-1-3_1460_125
42340_2-4-8-1-3_1460_113
64240_2-4-8-1-3_1400_103

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.361404
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0542
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36296
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36267
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36240
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15227
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0164
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36128
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0115
Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0110

Country

fingerprintco-occurrences
SG · Singapore4599
US · United States53
CN · China29
NL · Netherlands18
FR · France11
FI · Finland7
RU · Russia6
CH · Switzerland5
BR · Brazil3
LT · Lithuania3

Network (ASN)

fingerprintco-occurrences
AS45102 · Alibaba (US) Technology Co., Ltd.4596
AS8075 · Microsoft Corporation12
AS197170 · TechTies Inc.12
AS56040 · China Mobile communications corporation12
AS11351 · Charter Communications Inc11
AS4134 · CHINANET BACKBONE10
AS36351 · IBM Cloud7
AS14061 · DigitalOcean, LLC5
AS51852 · Private Layer INC5
AS24940 · Hetzner Online GmbH4

TLS supported groups

fingerprintco-occurrences
001d,0017,001e,0019,0018,0100,0101,0102,0103,0104 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, php-guzzle 8.3.1, curl 7.88.1, +10 more.The fingerprint page shows the full measured match list. More on the catalog.2140