TLS ClientHello (JA4)

q13d0311h3_55b375c5d22e_f2a83c8e78ae

first seen 2026-06-17 18:27 · last seen 2026-09-16 11:15 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog →

urlsession 6.3.3 · macOS 26.6.2 · ci — 1 session, last 2026-09-07 22:34 controlled
urlsession 6.1.2 · macOS 15.7.9 · ci — 1 session, last 2026-09-07 22:33 controlled
safari 26.6.2 · macOS 26.6.2 · ci — 2 sessions, last 2026-09-07 22:28 controlled
safari 26.6.1 · macOS 15.7.9 · ci — 1 session, last 2026-09-07 22:27 controlled
urlsession 6.3.3 · macOS 26.5.2 · ci — 8 sessions, last 2026-09-01 01:05 controlled
safari 26.5.2 · macOS 26.5.2 · ci — 16 sessions, last 2026-09-01 00:58 controlled
safari 26.5.2 · macOS 15.7.7 · ci — 16 sessions, last 2026-09-01 00:57 controlled
urlsession 6.1.2 · macOS 15.7.7 · ci — 9 sessions, last 2026-08-26 06:55 controlled
urlsession 6.3.2 · macOS 26.4 · ci — 1 session, last 2026-08-01 00:40 controlled
safari 26.4 · macOS 26.4 · ci — 3 sessions, last 2026-07-03 03:52 controlled

Inconsistencies

User-Agents observed with this fingerprint that contradict what it proves at the wire. all inconsistencies →

fingerprint User-Agent claims wire shows confidence seen first seen last seen

q13d0311h3_55b375c5d22e_f2a83c8e78ae

Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_2 like M…

User-Agent claims Chrome 150.0.7871.113

TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-Agent	Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.113 Mobile/15E148 Safari/604.1
Claimed version	150.0.7871.113
Measured versions	151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layer	cipher suites match; extension set or signature algorithms differ
JA4 label	unlabeled

low

2026-08-01

2026-08-02

q13d0311h3_55b375c5d22e_f2a83c8e78ae

Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_0 like M…

User-Agent claims Chrome 149.0.7827.137

TLS extensions or signature algorithms differ from every measured Chrome capture

Full User-Agent	Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.7827.137 Mobile/15E148 Safari/604.1
Claimed version	149.0.7827.137
Measured versions	151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layer	cipher suites match; extension set or signature algorithms differ
JA4 label	unlabeled

low

2026-06-26

q13d0311h3_55b375c5d22e_f2a83c8e78ae

Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac…

User-Agent claims Firefox 151

TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-Agent	Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/151 Mobile/15E148 Version/18.6
Claimed version	151
Measured versions	146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layer	cipher suites match; extension set or signature algorithms differ
JA4 label	unlabeled

low

2026-07-01

q13d0311h3_55b375c5d22e_f2a83c8e78ae

Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_1 like M…

User-Agent claims Chrome 150.0.7871.113

TLS extensions or signature algorithms differ from every measured Chrome capture

Full User-Agent	Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.113 Mobile/15E148 Safari/604.1
Claimed version	150.0.7871.113
Measured versions	151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layer	cipher suites match; extension set or signature algorithms differ
JA4 label	unlabeled

low

2026-07-17

q13d0311h3_55b375c5d22e_f2a83c8e78ae

Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like M…

User-Agent claims Chrome 152.0.7977.64

TLS extensions or signature algorithms differ from every measured Chrome capture

Full User-Agent	Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.64 Mobile/15E148 Safari/604.1
Claimed version	152.0.7977.64
Measured versions	151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layer	cipher suites match; extension set or signature algorithms differ
JA4 label	unlabeled

low

2026-09-11

q13d0311h3_55b375c5d22e_f2a83c8e78ae

Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like M…

User-Agent claims Chrome 153.0.8010.24

TLS extensions or signature algorithms differ from every measured Chrome capture

Full User-Agent	Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1
Claimed version	153.0.8010.24
Measured versions	151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layer	cipher suites match; extension set or signature algorithms differ
JA4 label	unlabeled

low

2026-09-12

Last 7 days (30 observations)

Distinct clients per day (last 30 days, peak 10/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocol	`q (QUIC)`
TLS version	`13`
SNI	`d (domain)`
Cipher count	`3`
Extension count	`11`
ALPN	`h3`
Ciphers	`1301, 1302, 1303`
Extensions	`0005, 000a, 000d, 0012, 001b, 002b, 002d, 0033, 0039`
Signature algorithms	`0403, 0804, 0401, 0503, 0805, 0805, 0501, 0806, 0601, 0201`
JA4_r	`q13d0311h3_1301,1302,1303_0005,000a,000d,0012,001b,002b,002d,0033,0039_0403,0804,0401,0503,0805,0805,0501,0806,0601,0201`
JA4_o (sample)	`q13d0311h3_0ce35177f2fe_b2d0da0e8442`
JA4_ro (sample)	`q13d0311h3_1302,1303,1301_0000,000a,0010,0005,000d,0012,0033,002d,002b,0039,001b_0403,0804,0401,0503,0805,0805,0501,0806,0601,0201`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprint	co-occurrences
`ge30nn05enus_892e8e8cf56b_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2, urlsession 6.3.3, urlsession 6.3.2.The fingerprint page shows the full measured match list. More on the catalog.	59
`ge30nn08enus_1945e0741196_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.5, safari 26.6.2, +1 more.The fingerprint page shows the full measured match list. More on the catalog.	38
`ge30nn05engb_730e0cd04a06_000000000000_000000000000`	25
`ge30nn08engb_b65a39d4559c_000000000000_000000000000`	24
`ge30nr09enus_5ad46a65401a_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.4, safari 26.5, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	22
`ge30nr08enus_1945e0741196_000000000000_000000000000`	20
`ge30nn08engb_1945e0741196_000000000000_000000000000`	14
`ge30nr09enus_538441e4e116_000000000000_000000000000`	13
`ge30nn05engb_892e8e8cf56b_000000000000_000000000000`	12
`ge30nn07enus_77221925c655_000000000000_000000000000`	11

QUIC transport params

fingerprint	co-occurrences
`q07_e80dd4933807` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, urlsession 6.3.3, safari 26.4, +2 more.The fingerprint page shows the full measured match list. More on the catalog.	357
`q08_52ebd28059b7` Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, urlsession 6.1.2, safari 26.5, +1 more.The fingerprint page shows the full measured match list. More on the catalog.	71
`q08_17f5c3ee087c`	9
`q08_364539a9f43d`	9
`q09_710c4f0dd2a5`	3
`q08_bae576bf37b0` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.18.0.The fingerprint page shows the full measured match list. More on the catalog.	2

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1`	37
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0`	31
`Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1`	28
`HackerNews/1566 CFNetwork/3860.600.12 Darwin/25.5.0`	26
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15`	23
`HackerNews/1545 CFNetwork/3860.600.12 Darwin/25.5.0`	21
`Hydra/21 CFNetwork/3860.600.12 Darwin/25.5.0`	16
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15`	15
`Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1`	15
`Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Mobile/15E148 Safari/604.1`	14

Country

fingerprint	co-occurrences
`US` · United States	148
`PT` · Portugal	56
`GB` · United Kingdom	26
`DE` · Germany	23
`CA` · Canada	21
`EE` · Estonia	19
`DK` · Denmark	16
`CN` · China	15
`JP` · Japan	14
`ES` · Spain	13

Network (ASN)

fingerprint	co-occurrences
`AS2860` · NOS COMUNICACOES, S.A.	56
`AS7922` · Comcast Cable Communications, LLC	30
`AS44869` · FIBIA P/S	14
`AS3209` · Vodafone GmbH	13
`AS209` · CenturyLink Communications, LLC	12
`AS3249` · Telia Eesti AS	12
`AS7018` · AT&T Enterprises, LLC	10
`AS714` · Apple Inc.	10
`AS6167` · Verizon Business	9
`AS13335` · Cloudflare, Inc.	8

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprint	linked observations
`t13d2013h2_a09f3c656075_7f0f34a4126d`	66
`t13d2014h2_a09f3c656075_e42f34c56612`	10
`t13d1313h2_f57a46bbacb6_7f0f34a4126d`	1