TLS ClientHello (JA4)

t13d0307h2_55b375c5d22e_e31b90bacf3d

first seen 2026-08-31 16:10 · last seen 2026-08-31 16:10 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count3
Extension count7
ALPNh2
Ciphers1301, 1302, 1303
Extensions000a, 000d, 002b, 002d, 0033
Signature algorithms0403, 0503, 0603, 0804, 0805, 0806, 0401, 0501, 0601, 0203, 0201
JA4_rt13d0307h2_1301,1302,1303_000a,000d,002b,002d,0033_0403,0503,0603,0804,0805,0806,0401,0501,0601,0203,0201
JA4_o (sample)t13d0307h2_55b375c5d22e_5efa8755433e
JA4_ro (sample)t13d0307h2_1301,1302,1303_002b,000a,0033,000d,0000,0010,002d_0403,0503,0603,0804,0805,0806,0401,0501,0601,0203,0201

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn010000_a510e5066512_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: java-httpclient 17.0.19, java-httpclient 11.0.31, java-httpclient 25.0.3, +6 more.The fingerprint page shows the full measured match list. More on the catalog.1

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:65536;3:1000;4:6291456;5:16384;6:262144|15663105|0|m,a,s,p1

TCP SYN (p0f)

fingerprintco-occurrences
4:111+17:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-1-3-1-1-4_1460_81

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.11

Country

fingerprintco-occurrences
DE · Germany1

Network (ASN)

fingerprintco-occurrences
AS24940 · Hetzner Online GmbH1