TLS ClientHello (JA4)

t12d190800_d83cc789557e_16bbda4055b2

first seen 2026-06-28 19:35 · last seen 2026-10-20 23:48 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version12
SNId (domain)
Cipher count19
Extension count8
ALPN00
Ciphers000a, 002f, 0035, 003c, 003d, 009c, 009d, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030
Extensions0005, 000a, 000b, 000d, 0017, 0023, ff01
Signature algorithms0401, 0501, 0201, 0403, 0503, 0203, 0202, 0601, 0603
JA4_rt12d190800_000a,002f,0035,003c,003d,009c,009d,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030_0005,000a,000b,000d,0017,0023,ff01_0401,0501,0201,0403,0503,0203,0202,0601,0603
JA4_o (sample)t12d190800_e8d5f427a2c5_a8d70fcb9ff4
JA4_ro (sample)t12d190800_c02c,c02b,c030,c02f,c024,c023,c028,c027,c00a,c009,c014,c013,009d,009c,003d,003c,0035,002f,000a_0000,0005,000a,000b,000d,0023,0017,ff01_0401,0501,0201,0403,0503,0203,0202,0601,0603

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn040000_cabeb744284e_000000000000_0000000000005
ge11nn040000_580a00142f88_000000000000_0000000000001
po11nn07enus_7d361e250c48_000000000000_0000000000001
po11nn07ptbr_7d361e250c48_000000000000_0000000000001
po11nn07frfr_7d361e250c48_000000000000_0000000000001
po11nn07enph_7d361e250c48_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:119+9:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:02
6:46+18:0:1440:mss*45,8:mss,nop,ws,nop,nop,sok:flow:01
6:54+10:0:1390:mss*47,8:mss,nop,ws,nop,nop,sok:flow:01
4:113+15:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01
4:113+15:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:120+8:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01
4:106+22:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:119+9:0:1400:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01
6:49+15:0:1412:mss*45,8:mss,nop,ws,nop,nop,sok:flow:01

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-1-3-1-1-4_1460_84
64240_2-1-3-1-1-4_1440_81
65535_2-1-3-1-1-4_1440_81
64800_2-1-3-1-1-4_1440_81
64240_2-1-3-1-1-4_1400_81
64800_2-1-3-1-1-4_1412_81

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.365
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)1
Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/90.0.0.0 Safari/537.361
Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.361
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/71.0.0.0 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/62.0.0.0 Safari/537.361

Country

fingerprintco-occurrences
US · United States2
BR · Brazil2
SG · Singapore1
CA · Canada1
GB · United Kingdom1
FR · France1
PH · Philippines1
PK · Pakistan1

Network (ASN)

fingerprintco-occurrences
AS40021 · Contabo Inc.2
AS8075 · Microsoft Corporation1
AS25369 · Hydra Communications Ltd1
AS9299 · Philippine Long Distance Telephone Company1
AS852 · TELUS Communications Inc.1
AS22085 · Claro S/A1
AS12322 · Free SAS1
AS17539 · NetSol Connect1
AS61657 · Jr Net Informatica Ltda - ME1

TLS supported groups

fingerprintco-occurrences
001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.11.27, winhttp 10.0.20348.1, +2 more.The fingerprint page shows the full measured match list. More on the catalog.1