TLS ClientHello (JA4)

t13d1516h1_8daaf6152771_d8a2da3f94cd

first seen 2026-06-12 03:02 · last seen 2026-09-13 08:06 · JSON

Last 7 days (38 observations)

Distinct clients per day (last 30 days, peak 20/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count15
Extension count16
ALPNh1
Ciphers002f, 0035, 009c, 009d, 1301, 1302, 1303, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 001b, 0023, 002b, 002d, 0033, 44cd, fe0d, ff01
Signature algorithms0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601
JA4_rt13d1516h1_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,001b,0023,002b,002d,0033,44cd,fe0d,ff01_0403,0804,0401,0503,0805,0501,0806,0601
JA4_o (sample)t13d1516h1_acb858a92679_50c13e338054
JA4_ro (sample)t13d1516h1_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_002b,0033,0005,001b,0017,000b,0012,44cd,000a,ff01,0023,002d,0000,000d,0010,fe0d_0403,0804,0401,0503,0805,0501,0806,0601

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn14enus_f373e780f670_000000000000_00000000000073
po11nr15enus_09e4ed5d8ed5_000000000000_00000000000032
ge11nr13enus_e965362ed9da_000000000000_00000000000022
ge11nn12enus_8eff6c7bee97_000000000000_00000000000017
po11nr14enus_6397384559be_000000000000_0000000000009
ge11nr14enus_720e99a7fa86_000000000000_0000000000005
ge11nr14engb_535d0194b751_000000000000_0000000000004
po11nr15enus_69cd38b0450c_000000000000_0000000000003
ge11nr14enau_535d0194b751_000000000000_0000000000003
ge11nr14enus_4a2844af1d7f_000000000000_0000000000002

TCP SYN (p0f)

fingerprintco-occurrences
4:50+14:0:1460:35844,0:mss,?34,nop,nop:df,id+:052
4:53+11:0:1460:35844,0:mss,?34,nop,nop:df,id+:029
4:54+10:0:1460:35844,0:mss,?34,nop,nop:df,id+:013
4:111+17:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+:08
4:58+6:0:1420:mss*46,12:mss,sok,ts,nop,ws:df,id+:08
4:56+8:0:1460:mss*29,12:mss,sok,ts,nop,ws,?34,nop,nop:df,id+:08
4:47+17:0:1460:65535,3:mss,sok,ts,nop,ws:df,id+:07
4:46+18:0:1440:65535,0:mss,?34,nop,nop:df,id+:06
4:45+19:0:1440:65535,0:mss,?34,nop,nop:df,id+:06
4:57+7:0:1460:mss*44,12:mss,sok,ts,nop,ws,?34,nop,nop:df,id+:05

TCP SYN (JA4T)

fingerprintco-occurrences
35844_2-34-1-1_1460_0094
65535_2-34-1-1_1440_0012
42340_2-4-8-1-3-34-1-1_1460_1211
35844_2-254_1460_0010
65535_2-1-3-1-1-4_1440_88
64240_2-4-8-1-3_1440_108
65320_2-4-8-1-3_1420_128
65535_2-4-8-1-3_1460_37
64240_2-4-8-1-3-34-1-1_1460_116
64240_2-4-8-1-3-34-1-1_1460_125

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.3659
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.3625
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.3622
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.3620
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.3620
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.3616
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.368
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.365
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.365
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.364

Country

fingerprintco-occurrences
US · United States172
NL · Netherlands16
CN · China8
DE · Germany2
VN · Vietnam1

Network (ASN)

fingerprintco-occurrences
AS14618 · Amazon.com, Inc.109
AS396982 · Google LLC25
AS14061 · DigitalOcean, LLC22
AS8075 · Microsoft Corporation21
AS4134 · CHINANET BACKBONE8
AS197170 · TechTies Inc.7
AS47674 · Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA4
AS13101 · TNG Stadtnetz GmbH2
AS7552 · Viettel Group1