TLS ClientHello (JA4)

t13d171000_5b57614c22b0_78e6aca7449b

first seen 2026-07-01 14:37 · last seen 2026-08-09 00:02 · JSON

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count17
Extension count10
ALPN00
Ciphers002f, 0035, 009c, 009d, 1301, 1302, 1303, c009, c00a, c013, c014, c02b, c02c, c02f, c030, cca8, cca9
Extensions000a, 000b, 000d, 0017, 0023, 002b, 002d, 0033, ff01
Signature algorithms0403, 0804, 0401, 0503, 0805, 0501, 0806, 0601, 0201
JA4_rt13d171000_002f,0035,009c,009d,1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0017,0023,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0501,0806,0601,0201
JA4_o (sample)t13d171000_bbc337f0a232_e926dfe0188b
JA4_ro (sample)t13d171000_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c009,c013,c00a,c014,009c,009d,002f,0035_0000,0017,ff01,000a,000b,0023,000d,0033,002d,002b_0403,0804,0401,0503,0805,0501,0806,0601,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn050000_2469c960a647_000000000000_00000000000015
ge11nn050000_b5e847c80b4c_000000000000_00000000000013
ge11nr11engb_d21348767826_000000000000_0000000000002
ge11nn030000_58c83775e1a3_000000000000_0000000000001
he11nn030000_58c83775e1a3_000000000000_0000000000001
ge11nn12enus_cb10ea1dea51_000000000000_0000000000001
ge11nn12enus_dee490167315_000000000000_0000000000001
ge11nn10engb_aa59d875b51d_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:45+19:0:1250:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:03
4:50+14:0:1460:mss*29,10:mss,sok,ts,nop,ws:df,id+:02
4:119+9:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:02
4:49+15:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:02
4:55+9:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:02
4:45+19:0:1360:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:02
4:46+18:0:1379:mss*44,10:mss,sok,ts,nop,ws:df,id+:02
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
6:43+21:0:1440:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:ecn,flow:01
4:47+17:0:1452:65535,9:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
42340_2-4-8-1-3_1460_103
65535_2-1-3-1-1-8-4-0-0_1250_63
64240_2-4-8-1-3_1460_102
64240_2-1-3-1-1-4_1460_82
65535_2-4-8-1-3_1460_92
65535_2-1-3-1-1-8-4-0-0_1440_62
65535_2-4-8-1-3_1452_92
65535_2-4-8-1-3_1460_82
65535_2-1-3-1-1-8-4-0-0_1360_62
64240_2-4-8-1-3_1379_102

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.113
Claude-User (claude-code/2.1.220; +https://support.anthropic.com/)4
Claude-User (claude-code/2.1.226; +https://support.anthropic.com/)4
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.153
Goguma (+https://codeberg.org/emersion/goguma)2
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.3.1 Safari/605.1.151
Claude-User (claude-code/2.1.196; +https://support.anthropic.com/)1
Claude-User (claude-code/2.1.197; +https://support.anthropic.com/)1
Claude-User (claude-code/2.1.208; +https://support.anthropic.com/)1

Country

fingerprintco-occurrences
US · United States8
SG · Singapore4
RO · Romania3
AU · Australia2
GB · United Kingdom2
FR · France2
CZ · Czechia2
IL · Israel2
DE · Germany1
NL · Netherlands1

Network (ASN)

fingerprintco-occurrences
AS396856 · Sharon Networks, LLC3
AS42424 · ICS Endava SRL3
AS38195 · Superloop2
AS12400 · Partner Communications Ltd.2
AS395839 · HOSTKEY2
AS29208 · Quantcom, a.s.2
AS22773 · Cox Communications Inc.1
AS12887 · Netia SA1
AS7922 · Comcast Cable Communications, LLC1
AS8881 · 1&1 Versatel GmbH1