TLS ClientHello (JA4)

t13d131000_f57a46bbacb6_e7c285222651

first seen 2026-06-11 02:09 · last seen 2026-11-01 15:47 · JSON

Last 7 days (53 observations)

Distinct clients per day (last 30 days, peak 6/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count13
Extension count10
ALPN00
Ciphers1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 002b, 0033, ff01
Signature algorithms0804, 0403, 0807, 0805, 0806, 0401, 0501, 0601, 0503, 0603, 0201, 0203
JA4_rt13d131000_1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203
JA4_o (sample)t13d131000_45672f90a73c_7afa19738a2d
JA4_ro (sample)t13d131000_c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,1301,1302,1303_0000,000b,ff01,0017,0012,0005,000a,000d,002b,0033_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn10zhcn_9c0cf7475f83_000000000000_0000000000001271
ge11nr10zhcn_9c0cf7475f83_000000000000_000000000000345
ge11nn08zhcn_bd35aedc6348_000000000000_000000000000171
ge11nn10zhcn_986c3fb09fa9_000000000000_000000000000160
ge11nr08zhcn_bd35aedc6348_000000000000_000000000000129
ge11nr05zhcn_f3bb7aa45ec4_000000000000_00000000000091
ge11nr030000_cd680697de12_000000000000_00000000000073
ge11nn030000_cd680697de12_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.5, powershell 7.6.4, +11 more.The fingerprint page shows the full measured match list. More on the catalog.51
ge11nn050000_3658ef221638_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.25.0, wget 1.21.3.The fingerprint page shows the full measured match list. More on the catalog.48
ge11nr14ruru_dfdfe003b035_000000000000_00000000000041

TCP SYN (p0f)

fingerprintco-occurrences
4:50+14:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:0443
4:49+15:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:0315
4:53+11:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:0285
4:51+13:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:0261
4:47+17:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:0209
4:52+12:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:0162
4:43+21:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:093
4:45+19:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:078
4:44+20:0:1424:mss*20,7:mss,sok,ts,nop,ws:df,id+:078
4:56+8:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:074

TCP SYN (JA4T)

fingerprintco-occurrences
29200_2-4-8-1-3_1424_71583
42340_2-4-8-1-3_1460_12121
64240_2-4-8-1-3_1460_7117
64952_2-4-8-1-3_1412_748
64860_2-4-8-1-3_1410_744
64240_2-4-8-1-3_1460_1036
32476_2-4-8-1-3_1412_736
64620_2-4-8-1-3_1436_725
64240_2-4-8-1-3_1412_718
64240_2-4-8-1-3_1400_717

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.12104
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0121
metabase-cve-2026-72898-detect/1.0 (benign detection probes only)51
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.3644
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.041
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3625
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3624
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.022
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3622
Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.014

Country

fingerprintco-occurrences
US · United States513
DE · Germany506
BR · Brazil391
KR · South Korea350
HK · Hong Kong SAR China339
JP · Japan233
NL · Netherlands160
FR · France58
CN · China56
ID · Indonesia49

Network (ASN)

fingerprintco-occurrences
AS132203 · Tencent Building, Kejizhongyi Avenue2104
AS48090 · TECHOFF SRV LIMITED135
AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED108
AS215599 · Zkillu SAS45
AS141679 · China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch44
AS22295 · Advin Services LLC39
AS204770 · UAB "Cherry Servers"36
AS400529 · Infraly, LLC26
AS14061 · DigitalOcean, LLC21
AS396982 · Google LLC13

TLS supported groups

fingerprintco-occurrences
11ec,001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 158.0.1, firefox 157.0, firefox 157.0.1, +5 more.The fingerprint page shows the full measured match list. More on the catalog.113
001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, curl 8.7.1.The fingerprint page shows the full measured match list. More on the catalog.10
6399,001d,0017,0018,00192