TLS ClientHello (JA4)

t12d220700_0d4ca5d4ec72_3304d8368043

first seen 2026-07-01 14:36 · last seen 2026-07-07 15:34 · JSON

Decomposed attributes

Protocol	`t (TLS over TCP)`
TLS version	`12`
SNI	`d (domain)`
Cipher count	`22`
Extension count	`7`
ALPN	`00`
Ciphers	`000a, 002f, 0035, 003c, 003d, 009c, 009d, 00ff, c008, c009, c00a, c012, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030`
Extensions	`0005, 000a, 000b, 000d, 0012, 0017`
Signature algorithms	`0401, 0201, 0501, 0601, 0403, 0203, 0503, 0603`
JA4_r	`t12d220700_000a,002f,0035,003c,003d,009c,009d,00ff,c008,c009,c00a,c012,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030_0005,000a,000b,000d,0012,0017_0401,0201,0501,0601,0403,0203,0503,0603`
JA4_o (sample)	`t12d220700_f0c2e9889a98_5e7a020dc935`
JA4_ro (sample)	`t12d220700_00ff,c02c,c02b,c024,c023,c00a,c009,c008,c030,c02f,c028,c027,c014,c013,c012,009d,009c,003d,003c,0035,002f,000a_0000,000a,000b,000d,0005,0012,0017_0401,0201,0501,0601,0403,0203,0503,0603`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn040000_cf1edba2959c_000000000000_000000000000`	1
`ge11nn06enus_6a79d837b13a_000000000000_000000000000`	1

TCP SYN (p0f)

fingerprint	co-occurrences
`4:53+11:0:1460:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:0`	1
`4:58+6:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0`	1

TCP SYN (JA4T)

fingerprint	co-occurrences
`65535_2-4-8-1-3_1460_9`	1
`65535_2-1-3-1-1-8-4-0-0_1460_6`	1

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36`	1
`HackerSearchBot/0.1 (article-content enrichment)`	1

Country

fingerprint	co-occurrences
`US` · United States	1
`FR` · France	1

Network (ASN)

fingerprint	co-occurrences
`AS6461` · Zayo Bandwidth	1
`AS141039` · PacketHub S.A.	1