TLS ClientHello (JA4)

q13d0311h3_55b375c5d22e_f2a83c8e78ae

first seen 2026-06-17 18:27 · last seen 2026-11-01 00:09 · JSON

Last 7 days (6 observations)

Distinct clients per day (last 30 days, peak 4/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolq (QUIC)
TLS version13
SNId (domain)
Cipher count3
Extension count11
ALPNh3
Ciphers1301, 1302, 1303
Extensions0005, 000a, 000d, 0012, 001b, 002b, 002d, 0033, 0039
Signature algorithms0403, 0804, 0401, 0503, 0805, 0805, 0501, 0806, 0601, 0201
JA4_rq13d0311h3_1301,1302,1303_0005,000a,000d,0012,001b,002b,002d,0033,0039_0403,0804,0401,0503,0805,0805,0501,0806,0601,0201
JA4_o (sample)q13d0311h3_0ce35177f2fe_b2d0da0e8442
JA4_ro (sample)q13d0311h3_1302,1303,1301_0000,000a,0010,0005,000d,0012,0033,002d,002b,0039,001b_0403,0804,0401,0503,0805,0805,0501,0806,0601,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge30nn05enus_892e8e8cf56b_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2, urlsession 6.3.3, urlsession 6.3.2.The fingerprint page shows the full measured match list. More on the catalog.59
ge30nn08enus_1945e0741196_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.6.1, +2 more.The fingerprint page shows the full measured match list. More on the catalog.42
ge30nr09enus_5ad46a65401a_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.6.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.27
ge30nn08engb_b65a39d4559c_000000000000_00000000000026
ge30nn05engb_730e0cd04a06_000000000000_00000000000026
ge30nr08enus_1945e0741196_000000000000_00000000000024
ge30nn08engb_1945e0741196_000000000000_00000000000019
ge30nr09enus_538441e4e116_000000000000_00000000000015
ge30nr08engb_1945e0741196_000000000000_00000000000015
ge30nn05engb_892e8e8cf56b_000000000000_00000000000013

QUIC transport params

fingerprintco-occurrences
q07_e80dd4933807 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, urlsession 6.3.3, safari 26.6.2, +2 more.The fingerprint page shows the full measured match list. More on the catalog.387
q08_52ebd28059b7 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, urlsession 6.1.2, safari 26.5, +2 more.The fingerprint page shows the full measured match list. More on the catalog.87
q08_364539a9f43d33
q09_710c4f0dd2a525
q08_17f5c3ee087c9
q08_bae576bf37b0 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.18.0.The fingerprint page shows the full measured match list. More on the catalog.2

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.137
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.036
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.130
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.1527
HackerNews/1566 CFNetwork/3860.600.12 Darwin/25.5.026
HackerNews/1545 CFNetwork/3860.600.12 Darwin/25.5.021
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.2 Safari/605.1.1518
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.1 Mobile/15E148 Safari/604.118
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0.1 Safari/605.1.1517
Hydra/21 CFNetwork/3860.600.12 Darwin/25.5.016

Country

fingerprintco-occurrences
US · United States181
PT · Portugal56
CA · Canada26
GB · United Kingdom26
DE · Germany24
DK · Denmark23
JP · Japan22
EE · Estonia21
CN · China17
TR · Turkey14

Network (ASN)

fingerprintco-occurrences
AS2860 · NOS COMUNICACOES, S.A.56
AS7922 · Comcast Cable Communications, LLC42
AS44869 · FIBIA P/S18
AS3209 · Vodafone GmbH13
AS209 · CenturyLink Communications, LLC12
AS3249 · Telia Eesti AS12
AS213155 · Yettel Hungary Ltd.12
AS22773 · Cox Communications Inc.11
AS7018 · AT&T Enterprises, LLC10
AS714 · Apple Inc.10

TLS supported groups

fingerprintco-occurrences
0a0a,11ec,001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.3.3, safari 26.6.2.The fingerprint page shows the full measured match list. More on the catalog.12
0a0a,001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2, safari 27.2.The fingerprint page shows the full measured match list. More on the catalog.3

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
t13d2013h2_a09f3c656075_7f0f34a4126d87
t13d2014h2_a09f3c656075_e42f34c5661212
t13d1313h2_f57a46bbacb6_7f0f34a4126d1