TLS ClientHello (JA4)

t13d2712h2_b4f9224df7c1_cbb9361b6bf9

first seen 2026-08-17 13:28 · last seen 2026-09-27 04:35 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count27
Extension count12
ALPNh2
Ciphers002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, 1301, 1302, 1303, c009, c00a, c013, c014, c024, c028, c02b, c02c, c02f, c030, cca8, cca9
Extensions000a, 000b, 000d, 0015, 0017, 0023, 002b, 002d, 0033, ff01
Signature algorithms0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601
JA4_rt13d2712h2_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,1301,1302,1303,c009,c00a,c013,c014,c024,c028,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0015,0017,0023,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0501,0806,0601
JA4_o (sample)t13d2712h2_78f19105a2c6_8cae22093da9
JA4_ro (sample)t13d2712h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,003c,003d,c024,c028,0033,0039,0067,006b,009e,009f,c009,c013,c00a,c014,009c,009d,002f,0035_0000,0017,ff01,000a,000b,0023,0010,000d,0033,002d,002b,0015_0403,0804,0401,0503,0805,0501,0806,0601

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn010000_379fadc6c8b7_000000000000_0000000000005
ge20nn020000_b89ce445e0b3_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.27.1, go-net/http 1.27.0, +14 more.The fingerprint page shows the full measured match list. More on the catalog.4
ge20nn030000_ff50983941c1_000000000000_0000000000001
ge20nn030000_afa057d9a858_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:65536;2:0;4:6291456;6:262144;4:1048576|15663105|1:0:0:256|m,a,s,p7
1:4096;2:0;4:65535|6291456|1:0:0:256|p,m,s,a1
1:4096;4:131072|8388608|1:0:0:256|s,p,m,a1
1:65536;2:1;3:100;4:65535;5:65536|6291456|1:0:0:256|p,a,s,m1
1:4096;2:1;3:100;4:6291456;5:16384;6:65536|8388608|1:0:0:256|p,s,m,a1

TCP SYN (p0f)

fingerprintco-occurrences
6:47+17:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:04
4:36+28:0:1460:65228,7:mss,nop,ws,sok,ts:df:02
4:112+16:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:111+17:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01
6:120+8:0:1320:mss*49,8:mss,nop,ws,nop,nop,sok:flow:01
4:54+10:0:1412:65535,11:mss,sok,ts,nop,ws:df,id+:01
4:53+11:0:1412:65535,11:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
64800_2-4-8-1-3_1440_74
65535_2-1-3-1-1-4_1460_82
65228_2-1-3-4-8_1460_72
65535_2-4-8-1-3_1412_112
64680_2-1-3-1-1-4_1320_81

User-Agent

fingerprintco-occurrences
GlassloomTLSAudit/1.02
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.4 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.1 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.1 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.9 Safari/605.1.151

Country

fingerprintco-occurrences
FI · Finland4
US · United States2
FR · France2
RU · Russia2
SE · Sweden1

Network (ASN)

fingerprintco-occurrences
AS24940 · Hetzner Online GmbH4
AS12322 · Free SAS2
AS2914 · NTT America, Inc.2
AS41601 · NEO Print Ltd.2
AS212238 · Datacamp Limited1