TLS ClientHello (JA4)

t13d201100_2b729b4bf6f3_9e7b989ebec8

first seen 2026-08-20 19:16 · last seen 2026-10-25 17:39 · JSON

Identified as IcedID ?Identity labels come from the community JA4+ database by FoxIO — applications observed with a JA4 fingerprint, not something this site measured. A JA4 identifies a TLS stack, so unrelated applications built on the same stack (notably the many Chromium-based browsers) legitimately share one: labels are a ranked distribution, never a verdict.Labels are loaded from a snapshot and cover only the JA4 family. Where a fingerprint page shows matches controlled captures, that is Thumbprint's own measured truth instead. More on methodology. — per the JA4+ database; JA4 is a TLS-stack fingerprint, so unrelated clients can share one.

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count20
Extension count11
ALPN00
Ciphers002f, 0035, 003c, 003d, 009c, 009d, 1301, 1302, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030
Extensions0005, 000a, 000d, 0017, 0023, 002b, 002d, 0031, 0033, ff01
Signature algorithms0804, 0805, 0806, 0401, 0501, 0201, 0403, 0503, 0203, 0202, 0601, 0603
JA4_rt13d201100_002f,0035,003c,003d,009c,009d,1301,1302,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030_0005,000a,000d,0017,0023,002b,002d,0031,0033,ff01_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603
JA4_o (sample)t13d201100_1079d97b4c9b_edda82b7ef27
JA4_ro (sample)t13d201100_1302,1301,c02c,c02b,c030,c02f,c024,c023,c028,c027,c00a,c009,c014,c013,009d,009c,003d,003c,0035,002f_0000,0005,002b,000d,0023,000a,0033,0031,0017,ff01,002d_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
po11nn07ptbr_7d361e250c48_000000000000_0000000000001
po11nn07engb_7d361e250c48_000000000000_0000000000001
po11nn07frlu_7d361e250c48_000000000000_0000000000001
po11nn07bg00_7d361e250c48_000000000000_0000000000001
po11nn07enrw_7d361e250c48_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:113+15:0:1452:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:105+23:0:1452:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:103+25:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01
6:45+19:0:1432:mss*45,8:mss,nop,ws,nop,nop,sok:flow:01
4:110+18:0:1386:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-1-3-1-1-4_1452_82
64240_2-1-3-1-1-4_1460_81
64440_2-1-3-1-1-4_1432_81
64240_2-1-3-1-1-4_1386_81

User-Agent

fingerprintco-occurrences
Jetpack by WordPress.com1
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/72.0.0.0 Safari/537.361
Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/83.0.0.0 Safari/537.361
Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.1)1
Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.361

Country

fingerprintco-occurrences
LU · Luxembourg1
BR · Brazil1
AT · Austria1
VN · Vietnam1
RW · Rwanda1

Network (ASN)

fingerprintco-occurrences
AS9009 · M247 Europe SRL1
AS18403 · FPT Telecom Company1
AS18881 · TELEFÔNICA BRASIL S.A1
AS6661 · POST Luxembourg1
AS37228 · KT RWANDA NETWORK Ltd1

TLS supported groups

fingerprintco-occurrences
001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.11.27, winhttp 10.0.20348.1, +2 more.The fingerprint page shows the full measured match list. More on the catalog.4