TLS ClientHello (JA4)

t13d2013h1_2b729b4bf6f3_e24568c0d440

first seen 2026-06-26 20:18 · last seen 2026-09-14 04:18 · JSON

Last 7 days (138 observations)

Distinct clients per day (last 30 days, peak 206/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count20
Extension count13
ALPNh1
Ciphers002f, 0035, 003c, 003d, 009c, 009d, 1301, 1302, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030
Extensions0005, 000a, 000b, 000d, 0017, 0023, 002b, 002d, 0031, 0033, ff01
Signature algorithms0804, 0805, 0806, 0401, 0501, 0201, 0403, 0503, 0203, 0202, 0601, 0603
JA4_rt13d2013h1_002f,0035,003c,003d,009c,009d,1301,1302,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030_0005,000a,000b,000d,0017,0023,002b,002d,0031,0033,ff01_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603
JA4_o (sample)t13d2013h1_1079d97b4c9b_53aa1bee5020
JA4_ro (sample)t13d2013h1_1302,1301,c02c,c02b,c030,c02f,c024,c023,c028,c027,c00a,c009,c014,c013,009d,009c,003d,003c,0035,002f_0000,0005,002b,000d,0023,000a,000b,0010,0033,0031,0017,ff01,002d_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn030000_fe444ad14866_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.16.0.The fingerprint page shows the full measured match list. More on the catalog.667
he11nn030000_fe444ad14866_000000000000_0000000000002
ge11nn030000_042112399351_000000000000_0000000000001
ge11nn040000_e1d2031bdfea_000000000000_0000000000001
ge11nn030000_0d34275228c4_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:050
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:038
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:028
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:018
4:50+14:0:1460:65535,4:mss,sok,ts,nop,ws:df,id+:015
4:49+15:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:014
4:51+13:0:1460:65535,4:mss,sok,ts,nop,ws:df,id+:014
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:013
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:012
4:52+12:0:1460:65535,4:mss,sok,ts,nop,ws:df,id+:012

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_1460_6192
65535_2-4-8-1-3_1460_469
65535_2-4-8-1-3_1460_858
64240_2-4-8-1-3_1460_754
65535_2-4-8-1-3_1460_246
64240_2-1-3-1-1-4_1360_839
64240_2-1-3-1-1-4_1400_824
64240_2-1-3-1-1-4_1354_816
64800_2-4-8-1-3_1440_712
65535_2-4-8-1-3_1440_612

User-Agent

fingerprintco-occurrences
curl/8.21.0546
curl/8.18.086
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/152.0.0.022
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.364
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.03
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.363
curl/8.19.02
curl/8.14.12
curl/8.16.02
curl/8.13.01

Country

fingerprintco-occurrences
US · United States522
JP · Japan103
VN · Vietnam12
PK · Pakistan11
NL · Netherlands4
GB · United Kingdom3
PL · Poland3
TW · Taiwan3
BR · Brazil2
IN · India2

Network (ASN)

fingerprintco-occurrences
AS7922 · Comcast Cable Communications, LLC185
AS4713 · NTT DOCOMO BUSINESS,Inc.43
AS7018 · AT&T Enterprises, LLC42
AS701 · Verizon Business27
AS20115 · Charter Communications LLC27
AS2514 · NTT PC Communications, Inc.25
AS22773 · Cox Communications Inc.22
AS6167 · Verizon Business16
AS21928 · T-Mobile USA, Inc.13
AS209 · CenturyLink Communications, LLC12