TLS ClientHello (JA4)

t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3

first seen 2026-06-12 19:36 · last seen 2026-10-31 00:18 · JSON

Last 7 days (3416 observations)

Distinct clients per day (last 30 days, peak 103/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count10
Extension count11
ALPNh2
Ciphers00ff, 1301, 1302, 1303, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0017, 0023, 002b, 002d, 0033
Signature algorithms0503, 0403, 0807, 0806, 0805, 0804, 0601, 0501, 0401
JA4_rt13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401
JA4_o (sample)t13d1011h2_b9b30c653583_6219942186c1
JA4_ro (sample)t13d1011h2_1302,1301,1303,c02c,c02b,cca9,c030,c02f,cca8,00ff_000b,0010,002b,0033,000d,002d,000a,0000,0017,0005,0023_0503,0403,0807,0806,0805,0804,0601,0501,0401

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn09enus_a1a0096bef8e_000000000000_00000000000019109
ge20nn050000_a36a3d5685e0_000000000000_0000000000001001
ge20nr050000_a36a3d5685e0_000000000000_000000000000982
ge20nn030000_80b089f68b8e_000000000000_000000000000716
ge20nn09enus_11021b20a09b_000000000000_000000000000190
ge20nn09enus_d6ebfc2f6ac9_000000000000_000000000000176
ge20nr060000_c57eabf9cebf_000000000000_00000000000037
ge20nn060000_c57eabf9cebf_000000000000_00000000000027
ge20nn020000_e5a56608905c_000000000000_00000000000012
ge20nn05enus_8db26f4ec8f0_000000000000_0000000000008

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.13.5, rust-reqwest 0.13.4, +4 more.The fingerprint page shows the full measured match list. More on the catalog.22288
2:0;4:65535;5:16384;6:65536|00|0|m,s,a,p4
2:0;4:65535;5:16384;6:16384|00|0|m,s,a,p2
2:0;4:2097152;5:16384;6:16777216|5177345|0|m,s,a,p2

TCP SYN (p0f)

fingerprintco-occurrences
4:57+7:0:1460:35424,7:mss,sok,ts,nop,ws:df,id+:019416
4:45+19:0:1390:65535,12:mss,sok,ts,nop,ws:df,id+:01114
4:44+20:0:1390:65535,12:mss,sok,ts,nop,ws:df,id+:0910
4:118+10:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0510
4:119+9:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0192
4:53+11:0:1460:35424,7:mss,sok,ts,nop,ws:df,id+:021
4:56+8:0:1460:35424,7:mss,sok,ts,nop,ws:df,id+:018
4:43+21:0:1390:65535,12:mss,sok,ts,nop,ws:df,id+:014
4:54+10:0:1460:35424,7:mss,sok,ts,nop,ws:df,id+:012
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:08

TCP SYN (JA4T)

fingerprintco-occurrences
35424_2-4-8-1-3_1460_719475
65535_2-4-8-1-3_1390_121980
62727_2-4-8-1-3_1460_7716
64240_2-4-8-1-3_1460_714
42600_2-4-8-1-3_1420_711
64240_2-4-8-1-3_1460_97
62587_2-4-8-1-3_1440_75
65535_2-1-3-1-1-4_1340_83
65535_2-1-3-1-1-8-4-0-0_1312_63
64240_2-4-8-1-3_1460_102

User-Agent

fingerprintco-occurrences
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.3619475
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot1244
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)716
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot471
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)332
Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)8
Mozilla/5.0 (compatible; grok-agent/1.0; +https://x.ai)6
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.365
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.364
WhatsApp/24

Country

fingerprintco-occurrences
US · United States22256
FR · France9
HU · Hungary7
DE · Germany6
PL · Poland5
RO · Romania4
FI · Finland3
AU · Australia1
NL · Netherlands1
CH · Switzerland1

Network (ASN)

fingerprintco-occurrences
AS396982 · Google LLC19486
AS8075 · Microsoft Corporation2047
AS16509 · Amazon.com, Inc.723
AS3215 · Orange S.A.9
AS701 · Verizon Business7
AS213155 · Yettel Hungary Ltd.5
AS24940 · Hetzner Online GmbH4
AS9009 · M247 Europe SRL4
AS218785 · TC DATACENTER LIMITED4
AS38195 · Superloop1

TLS supported groups

fingerprintco-occurrences
001d,0017,0018 Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.11.27, powershell 7.6.8, +1 more.The fingerprint page shows the full measured match list. More on the catalog.10420