TLS ClientHello (JA4)

t13d2012h1_2b729b4bf6f3_9e7b989ebec8

first seen 2026-08-09 19:44 · last seen 2026-09-16 04:31 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count20
Extension count12
ALPNh1
Ciphers002f, 0035, 003c, 003d, 009c, 009d, 1301, 1302, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030
Extensions0005, 000a, 000d, 0017, 0023, 002b, 002d, 0031, 0033, ff01
Signature algorithms0804, 0805, 0806, 0401, 0501, 0201, 0403, 0503, 0203, 0202, 0601, 0603
JA4_rt13d2012h1_002f,0035,003c,003d,009c,009d,1301,1302,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030_0005,000a,000d,0017,0023,002b,002d,0031,0033,ff01_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603
JA4_o (sample)t13d2012h1_1079d97b4c9b_05b492f88d50
JA4_ro (sample)t13d2012h1_1302,1301,c02c,c02b,c030,c02f,c024,c023,c028,c027,c00a,c009,c014,c013,009d,009c,003d,003c,0035,002f_0000,0005,002b,000d,0023,000a,0010,0033,0031,0017,ff01,002d_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn030000_fe444ad14866_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.16.0, curl 7.88.1, curl 8.21.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.75

TCP SYN (p0f)

fingerprintco-occurrences
4:114+14:0:1414:mss*44,8:mss,nop,ws,nop,nop,sok::08
4:115+13:0:1414:mss*44,8:mss,nop,ws,nop,nop,sok::08
4:116+12:0:1414:mss*44,8:mss,nop,ws,nop,nop,sok::06
4:110+18:0:1414:mss*44,8:mss,nop,ws,nop,nop,sok::04
4:113+15:0:1414:mss*44,8:mss,nop,ws,nop,nop,sok::04
4:112+16:0:1414:mss*44,8:mss,nop,ws,nop,nop,sok::03
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
6:52+12:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:02
6:48+16:0:1440:mss*45,8:mss,nop,ws,nop,nop,sok:flow:02
6:48+16:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:02

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-1-3-1-1-4_1414_842
64800_2-4-8-1-3_1440_78
65535_2-4-8-1-3_1460_68
64240_2-4-8-1-3_1460_75
64240_2-1-3-1-1-4_1240_84
64800_2-1-3-1-1-4_1440_82
65535_2-1-3-1-1-4_1440_81
64240_2-4-8-1-3_1452_71
65535_2-4-8-1-3_1432_61
64240_2-1-3-1-1-4_1360_81

User-Agent

fingerprintco-occurrences
curl/8.8.054
curl/8.7.17
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.367
'Mozilla/5.07

Country

fingerprintco-occurrences
JP · Japan55
US · United States20

Network (ASN)

fingerprintco-occurrences
AS2514 · NTT PC Communications, Inc.16
AS4713 · NTT DOCOMO BUSINESS,Inc.10
AS2516 · KDDI CORPORATION9
AS7922 · Comcast Cable Communications, LLC8
AS4725 · SoftBank Corp.5
AS10010 · TOKAI Communications Corporation4
AS10013 · FreeBit Co.,Ltd.4
AS4685 · Asahi Net3
AS7018 · AT&T Enterprises, LLC2
AS10796 · Charter Communications Inc2