TLS ClientHello (JA4)

t13d1312h2_f57a46bbacb6_f50d94e863eb

first seen 2026-08-19 21:02 · last seen 2026-10-31 23:56 · JSON

Last 7 days (61 observations)

Distinct clients per day (last 30 days, peak 4/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count13
Extension count12
ALPNh2
Ciphers1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0012, 0017, 002b, 0032, 0033, ff01
Signature algorithms0904, 0905, 0906, 0804, 0403, 0807, 0805, 0806, 0401, 0501, 0601, 0503, 0603
JA4_rt13d1312h2_1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,002b,0032,0033,ff01_0904,0905,0906,0804,0403,0807,0805,0806,0401,0501,0601,0503,0603
JA4_o (sample)t13d1312h2_45672f90a73c_0907710e1447
JA4_ro (sample)t13d1312h2_c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,1301,1302,1303_0000,000b,ff01,0017,0012,0005,000a,000d,0032,0010,002b,0033_0904,0905,0906,0804,0403,0807,0805,0806,0401,0501,0601,0503,0603

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nr020000_fb4f949fd323_000000000000_00000000000054
ge20nn020000_b89ce445e0b3_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.27.1, go-net/http 1.27.3, +14 more.The fingerprint page shows the full measured match list. More on the catalog.9
ge20nn020000_fb4f949fd323_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.9, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.9
ge20nn04enus_39a3ba4480e8_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2.The fingerprint page shows the full measured match list. More on the catalog.4
ge20nn030000_ff50983941c1_000000000000_0000000000003
ge20nn04enus_a1e84a948d10_000000000000_0000000000003
po20nn040000_8059d330de80_000000000000_0000000000003
ge20nn04enus_8325a3ce5a12_000000000000_0000000000001
he20nn010000_a510e5066512_000000000000_0000000000001
po20nn040000_389b5b1db9ed_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:4194304;5:1048576;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.1, go-net/http 1.27.3, go-net/http 1.27.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.130
2:0;4:4194304;5:16384;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.10, go-net/http 1.26.9, +8 more.The fingerprint page shows the full measured match list. More on the catalog.3

TCP SYN (p0f)

fingerprintco-occurrences
4:57+7:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:051
4:53+11:0:1460:mss*5,10:mss,sok,ts,nop,ws:df,id+,ecn:014
4:44+20:0:1460:mss*5,10:mss,sok,ts,nop,ws:df,id+,ecn:011
4:51+13:0:1460:mss*29,9:mss,sok,ts,nop,ws:df,id+:05
4:48+16:0:1460:mss*5,10:mss,sok,ts,nop,ws:df,id+,ecn:05
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:04
4:52+12:0:1460:mss*5,10:mss,sok,ts,nop,ws:df,id+,ecn:04
4:51+13:0:1280:mss*51,10:mss,sok,ts,nop,ws:df,id+:04
4:50+14:0:1280:mss*51,10:mss,sok,ts,nop,ws:df,id+:04
4:43+21:0:1460:mss*5,10:mss,sok,ts,nop,ws:df,id+,ecn:03

TCP SYN (JA4T)

fingerprintco-occurrences
42340_2-4-8-1-3_1460_1251
7300_2-4-8-1-3_1460_1051
42340_2-4-8-1-3_1460_99
65280_2-4-8-1-3_1280_109
64240_2-4-8-1-3_1460_74
65320_2-4-8-1-3_1420_103
64240_2-4-8-1-3_1460_102
64240_2-4-8-1-3_1440_102
64240_2-1-3-1-1-4_1440_81
42340_2-4-8-1-3_1460_101

User-Agent

fingerprintco-occurrences
curl/7.74.051
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.3643
Go-http-client/2.010
Mozilla/5.02
Mozilla/5.0 (compatible; Hister/v0.19.0 (118a73a); +https://hister.org/)2
Mozilla/5.0 (compatible; Crusader/1.0)2
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.362
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 OPR/112.0.0.02
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Mobile Safari/537.362
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.361

Country

fingerprintco-occurrences
NL · Netherlands65
US · United States24
MY · Malaysia13
DE · Germany12
SG · Singapore8
KR · South Korea4
JP · Japan2
CH · Switzerland2
BR · Brazil2
IN · India1

Network (ASN)

fingerprintco-occurrences
AS48090 · TECHOFF SRV LIMITED56
AS45102 · Alibaba (US) Technology Co., Ltd.51
AS39351 · 31173 Services AB6
AS4766 · Korea Telecom4
AS150303 · SoloRDP4
AS396982 · Google LLC3
AS8075 · Microsoft Corporation3
AS212238 · Datacamp Limited2
AS13030 · Init7 (Switzerland) Ltd.2
AS20473 · The Constant Company, LLC1

TLS supported groups

fingerprintco-occurrences
11ec,11eb,11ed,001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.3, go-net/http 1.26.10.The fingerprint page shows the full measured match list. More on the catalog.56
11ec,001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 158.0.1, firefox 157.0, firefox 157.0.1, +5 more.The fingerprint page shows the full measured match list. More on the catalog.19