TLS ClientHello (JA4)

t13d1516h1_8daaf6152771_d8a2da3f94cd

first seen 2026-06-12 03:02 · last seen 2026-10-29 19:52 · JSON

Last 7 days (20 observations)

Distinct clients per day (last 30 days, peak 2/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count15
Extension count16
ALPNh1
Ciphers002f, 0035, 009c, 009d, 1301, 1302, 1303, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 001b, 0023, 002b, 002d, 0033, 44cd, fe0d, ff01
Signature algorithms0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601
JA4_rt13d1516h1_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,001b,0023,002b,002d,0033,44cd,fe0d,ff01_0403,0804,0401,0503,0805,0501,0806,0601
JA4_o (sample)t13d1516h1_acb858a92679_baa6150501bd
JA4_ro (sample)t13d1516h1_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_0023,002d,0033,001b,0010,000b,ff01,44cd,0017,0005,0012,002b,fe0d,0000,000d,000a_0403,0804,0401,0503,0805,0501,0806,0601

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn14enus_f373e780f670_000000000000_00000000000075
po11nr15enus_09e4ed5d8ed5_000000000000_00000000000041
ge11nr13enus_e965362ed9da_000000000000_00000000000026
po11nr14enus_6397384559be_000000000000_00000000000018
ge11nn12enus_8eff6c7bee97_000000000000_00000000000017
ge11nr14enus_720e99a7fa86_000000000000_0000000000005
ge11nr12enus_8eff6c7bee97_000000000000_0000000000005
ge11nr14engb_535d0194b751_000000000000_0000000000004
po11nr15enus_69cd38b0450c_000000000000_0000000000003
ge11nr14enau_535d0194b751_000000000000_0000000000003

TCP SYN (p0f)

fingerprintco-occurrences
4:50+14:0:1460:35844,0:mss,?34,nop,nop:df,id+:052
4:53+11:0:1460:35844,0:mss,?34,nop,nop:df,id+:029
4:57+7:0:1460:35844,12:mss,sok,ts,nop,ws,?34,nop,nop:df,id+:016
4:54+10:0:1460:35844,0:mss,?34,nop,nop:df,id+:013
4:46+18:0:1440:65535,0:mss,?34,nop,nop:df,id+:011
4:111+17:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+:08
4:58+6:0:1420:mss*46,12:mss,sok,ts,nop,ws:df,id+:08
4:56+8:0:1460:mss*29,12:mss,sok,ts,nop,ws,?34,nop,nop:df,id+:08
4:45+19:0:1440:65535,0:mss,?34,nop,nop:df,id+:07
4:47+17:0:1460:65535,3:mss,sok,ts,nop,ws:df,id+:07

TCP SYN (JA4T)

fingerprintco-occurrences
35844_2-34-1-1_1460_0094
65535_2-34-1-1_1440_0018
35844_2-4-8-1-3-34-1-1_1460_1216
42340_2-4-8-1-3-34-1-1_1460_1211
35844_2-254_1460_0010
65535_2-1-3-1-1-4_1440_88
64240_2-4-8-1-3_1440_108
65320_2-4-8-1-3_1420_128
65535_2-4-8-1-3_1460_37
64240_2-4-8-1-3-34-1-1_1460_116

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.3669
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.3631
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.3624
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.3624
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.3620
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.3617
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.368
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.367
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.365
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.364

Country

fingerprintco-occurrences
US · United States201
NL · Netherlands17
CN · China8
DE · Germany2
VN · Vietnam1

Network (ASN)

fingerprintco-occurrences
AS14618 · Amazon.com, Inc.129
AS396982 · Google LLC28
AS8075 · Microsoft Corporation27
AS14061 · DigitalOcean, LLC22
AS4134 · CHINANET BACKBONE8
AS197170 · TechTies Inc.7
AS47674 · Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA4
AS13101 · TNG Stadtnetz GmbH2
AS7552 · Viettel Group1
AS218785 · TC DATACENTER LIMITED1

TLS supported groups

fingerprintco-occurrences
0a0a,11ec,001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: chrome 155.0.8059.40, chrome 156.0.8078.73, chromium 156.0.8078.47, +8 more.The fingerprint page shows the full measured match list. More on the catalog.23