TLS ClientHello (JA4)
t13i030800_55b375c5d22e_97f8aa674fd9
first seen 2026-06-12 09:40 · last seen 2026-06-12 09:40 · JSON
Decomposed attributes
| Protocol | t (TLS over TCP) |
|---|---|
| TLS version | 13 |
| SNI | i (no SNI / IP) |
| Cipher count | 3 |
| Extension count | 8 |
| ALPN | 00 |
| Ciphers | 1301, 1302, 1303 |
| Extensions | 0005, 000a, 000b, 000d, 0012, 002b, 0033, ff01 |
| Signature algorithms | 0804, 0403, 0807, 0805, 0806, 0401, 0501, 0601, 0503, 0603, 0201, 0203 |
| JA4_r | t13i030800_1301,1302,1303_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203 |
| JA4_o (sample) | t13i030800_d0bf4380f24c_9004777174f5 |
| JA4_ro (sample) | t13i030800_1303,1301,1302_0005,000a,000b,000d,ff01,0012,002b,0033_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203 |
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
HTTP request (JA4H)
| fingerprint | co-occurrences |
|---|---|
ge11nn040000_88d30a62b7ad_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.25.0.The fingerprint page shows the full measured match list. More on the catalog. | 1 |
TCP SYN (p0f)
| fingerprint | co-occurrences |
|---|---|
4:51+13:0:1460:mss*29,9:mss,nop,ws:df,id+:0 | 1 |
User-Agent
| fingerprint | co-occurrences |
|---|---|
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0 | 1 |
Country
| fingerprint | co-occurrences |
|---|---|
US · United States | 1 |
Network (ASN)
| fingerprint | co-occurrences |
|---|---|
AS6939 · Hurricane Electric LLC | 1 |