TLS ClientHello (JA4)

t13d301000_1d37bd780c83_3550537cd59b

first seen 2026-06-12 19:00 · last seen 2026-09-13 16:03 · JSON

Last 7 days (4 observations)

Distinct clients per day (last 30 days, peak 2/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count30
Extension count10
ALPN00
Ciphers002f, 0033, 0035, 0039, 003c, 003d, 0067, 006b, 009c, 009d, 009e, 009f, 1301, 1302, 1303, c009, c00a, c013, c014, c023, c024, c027, c028, c02b, c02c, c02f, c030, cca8, cca9, ccaa
Extensions000a, 000b, 000d, 0016, 0017, 002b, 002d, 0033, ff01
Signature algorithms0905, 0906, 0904, 0403, 0503, 0603, 0807, 0808, 081a, 081b, 081c, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0301, 0302, 0402, 0502, 0602, 0708
JA4_rt13d301000_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9,ccaa_000a,000b,000d,0016,0017,002b,002d,0033,ff01_0905,0906,0904,0403,0503,0603,0807,0808,081a,081b,081c,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602,0708
JA4_o (sample)t13d301000_8d44cdc55eec_083f78a5f82c
JA4_ro (sample)t13d301000_1302,1303,1301,c02c,c030,009f,cca9,cca8,ccaa,c02b,c02f,009e,c024,c028,006b,c023,c027,0067,c00a,c014,0039,c009,c013,0033,009d,009c,003d,003c,0035,002f_ff01,000b,000a,0016,0017,000d,002b,002d,0033,0000_0905,0906,0904,0403,0503,0603,0807,0808,081a,081b,081c,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602,0708

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nr08enus_002f1ef91713_000000000000_00000000000010777
ge11nr05en00_978ba9f30f5e_000000000000_0000000000007
ge11nn05en00_978ba9f30f5e_000000000000_0000000000003
ge11nn020000_2f58a845b48b_000000000000_0000000000002
ge11nr020000_2f58a845b48b_000000000000_0000000000002
ge11nn05en00_20ffb2d95d94_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02712
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01756
6:42+22:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:01691
6:41+23:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:01061
6:43+21:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0656
4:55+9:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0445
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0422
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0404
6:53+11:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0359
6:52+12:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0357

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_75947
64800_2-4-8-1-3_1440_74832
42600_2-4-8-1-3_1420_79
29200_2-4-8-1-3_1412_42
42340_2-4-8-1-3_1460_91

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.3610777
Scrapy/2.16.0 (+https://scrapy.org)5
Scrapy/2.17.0 (+https://scrapy.org)5
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.362
SitemapCrawler/1.02
Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.11

Country

fingerprintco-occurrences
FR · France10734
DE · Germany45
NL · Netherlands10
MX · Mexico2
HK · Hong Kong SAR China1

Network (ASN)

fingerprintco-occurrences
AS51167 · Contabo GmbH10779
AS396982 · Google LLC10
AS8151 · Uninet S.A. de C.V.2
AS23764 · CTGNet1