TLS ClientHello (JA4)

t13d1716h2_5b57614c22b0_0c27189014cf

first seen 2026-06-26 03:07 · last seen 2026-08-18 09:16 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count17
Extension count16
ALPNh2
Ciphers002f, 0035, 009c, 009d, 1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 001c, 0022, 0023, 002b, 002d, 0033, fe0d, ff01
Signature algorithms0403, 0503, 0603, 0804, 0805, 0806, 0401, 0501, 0601, 0203, 0201
JA4_rt13d1716h2_002f,0035,009c,009d,1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,001c,0022,0023,002b,002d,0033,fe0d,ff01_0403,0503,0603,0804,0805,0806,0401,0501,0601,0203,0201
JA4_o (sample)t13d1716h2_5b234860e130_7dae7bcd3fe2
JA4_ro (sample)t13d1716h2_1301,1303,1302,c02b,c02f,cca9,cca8,c02c,c030,c00a,c009,c013,c014,009c,009d,002f,0035_0000,0017,ff01,000a,000b,0023,0010,0005,0022,0012,0033,002b,000d,002d,001c,fe0d_0403,0503,0603,0804,0805,0806,0401,0501,0601,0203,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nr10enus_b3034183f430_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +21 more.The fingerprint page shows the full measured match list. More on the catalog.7
ge20nn11enus_3901d4197baf_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 153.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.7
ge20nr11enus_3901d4197baf_000000000000_0000000000004
ge20nr11cs00_187a9385d229_000000000000_0000000000003
ge20nr11enus_187a9385d229_000000000000_0000000000002
ge20nr12fr00_979a40433f82_000000000000_0000000000002
ge20nr11enus_dff93ddcf3c8_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 132.0, firefox 151.0.3, firefox 151.0.4, +1 more.The fingerprint page shows the full measured match list. More on the catalog.1
ge20nr12ruru_979a40433f82_000000000000_0000000000001
ge20nr10en00_b3034183f430_000000000000_0000000000001
ge20nn11cs00_684b26f0fcdf_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:65536;2:0;4:131072;5:16384|12517377|3:0:0:22|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +25 more.The fingerprint page shows the full measured match list. More on the catalog.12
1:65536;2:0;4:131072;5:16384|12517377|3:0:0:42|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.5
1:65536;2:0;4:131072;5:16384|12517377|5:0:0:22|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 154.0, firefox 153.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.2
1:65536;2:0;4:131072;5:16384|12517377|7:0:0:22|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0.3, firefox 155.0, firefox 154.0, +3 more.The fingerprint page shows the full measured match list. More on the catalog.2
1:65536;2:0;4:131072;5:16384|12517377|11:0:0:42|m,p,a,s2
1:65536;2:0;4:131072;5:16384|12517377|13:0:0:42|m,p,a,s2
1:65536;2:0;4:131072;5:16384|12517377|9:0:0:22|m,p,a,s1
1:65536;2:0;4:131072;5:16384|12517377|15:0:0:42|m,p,a,s1
1:65536;2:0;4:131072;5:16384|12517377|7:0:0:42|m,p,a,s1
1:65536;2:0;4:131072;5:16384|12517377|5:0:0:42|m,p,a,s1

TCP SYN (p0f)

fingerprintco-occurrences
4:113+15:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:014
4:50+14:0:1360:mss*44,10:mss,sok,ts,nop,ws:df,id+:04
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
4:47+17:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:01
4:48+16:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:01
4:50+14:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:01
4:50+14:0:1452:mss*44,10:mss,sok,ts,nop,ws:df,id+:01
4:53+11:0:1380:mss*47,10:mss,sok,ts,nop,ws:df,id+:01
6:246+9:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:01
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df:01

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-1-3-1-1-4_1440_814
64240_2-4-8-1-3_1360_104
64240_2-4-8-1-3_1460_103
64240_2-4-8-1-3_1460_72
64800_2-4-8-1-3_1440_71
64860_2-4-8-1-3_1380_101
65535_2-1-3-1-1-4_1460_81
64240_2-4-8-1-3_1452_71
64240_2-4-8-1-3_1452_101

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.014
Mozilla/5.0 (X11; Linux x86_64; rv:149.0) Gecko/20100101 Firefox/149.07
Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.06
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.01
Mozilla/5.0 (X11; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.01

Country

fingerprintco-occurrences
ID · Indonesia14
CZ · Czechia4
US · United States3
DE · Germany2
FR · France2
AU · Australia1
IT · Italy1
GE · Georgia1
AT · Austria1

Network (ASN)

fingerprintco-occurrences
AS9657 · Melsa-i-net AS14
AS24971 · MasterDC s.r.o.4
AS47583 · Hostinger International Limited2
AS19318 · Interserver, Inc2
AS41653 · Aqua Ray SAS2
AS35805 · JSC Silknet1
AS7018 · AT&T Enterprises, LLC1
AS8220 · COLT Technology Services Group Limited1
AS3269 · Telecom Italia S.p.A.1
AS10143 · Exetel Pty Ltd1

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
q13d0314h3_55b375c5d22e_61e396c58b1f6
q13d0315h3_55b375c5d22e_dc5437974b474