TLS ClientHello (JA4)

t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3

first seen 2026-06-12 19:36 · last seen 2026-09-15 21:13 · JSON

Last 7 days (201 observations)

Distinct clients per day (last 30 days, peak 16/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count10
Extension count11
ALPNh2
Ciphers00ff, 1301, 1302, 1303, c02b, c02c, c02f, c030, cca8, cca9
Extensions0005, 000a, 000b, 000d, 0017, 0023, 002b, 002d, 0033
Signature algorithms0503, 0403, 0807, 0806, 0805, 0804, 0601, 0501, 0401
JA4_rt13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401
JA4_o (sample)t13d1011h2_b9b30c653583_60ed62f8b24f
JA4_ro (sample)t13d1011h2_1302,1301,1303,c02c,c02b,cca9,c030,c02f,cca8,00ff_000b,000a,002d,0017,0000,000d,0005,0033,002b,0010,0023_0503,0403,0807,0806,0805,0804,0601,0501,0401

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge20nr050000_a36a3d5685e0_000000000000_000000000000514
ge20nn030000_80b089f68b8e_000000000000_000000000000369
ge20nn050000_a36a3d5685e0_000000000000_000000000000339
ge20nr060000_c57eabf9cebf_000000000000_00000000000037
ge20nn060000_c57eabf9cebf_000000000000_00000000000027
ge20nn04enus_39a3ba4480e8_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2.The fingerprint page shows the full measured match list. More on the catalog.6
ge20nn020000_e5a56608905c_000000000000_0000000000006
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.18.0, +9 more.The fingerprint page shows the full measured match list. More on the catalog.4
ge20nn09enus_d6ebfc2f6ac9_000000000000_0000000000004
ge20nn040000_93743a8df960_000000000000_0000000000003

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.13.4, rust-reqwest 0.12.28, rust-hyper 1.11.0, +3 more.The fingerprint page shows the full measured match list. More on the catalog.1325
2:0;4:65535;5:16384;6:16384|00|0|m,s,a,p2
2:0;4:2097152;5:16384;6:16777216|5177345|0|m,s,a,p2

TCP SYN (p0f)

fingerprintco-occurrences
4:44+20:0:1390:65535,12:mss,sok,ts,nop,ws:df,id+:0454
4:45+19:0:1390:65535,12:mss,sok,ts,nop,ws:df,id+:0443
4:118+10:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0206
4:119+9:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0150
4:43+21:0:1390:65535,12:mss,sok,ts,nop,ws:df,id+:011
4:120+8:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:08
4:50+14:0:1460:mss*44,9:mss,sok,ts,nop,ws:df,id+:07
4:56+8:0:1420:mss*30,7:mss,sok,ts,nop,ws:df,id+:06
4:117+11:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:05
4:42+22:0:1390:65535,12:mss,sok,ts,nop,ws:df,id+:05

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_1390_12850
62727_2-4-8-1-3_1460_7369
42600_2-4-8-1-3_1420_79
64240_2-4-8-1-3_1460_97
62587_2-4-8-1-3_1440_75
35424_2-4-8-1-3_1460_74
65535_2-1-3-1-1-4_1340_83
65535_2-1-3-1-1-8-4-0-0_1312_63
64240_2-4-8-1-3_1460_72
64240_2-4-8-1-3_1460_102

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot407
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)369
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot296
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)214
Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)6
Mozilla/5.0 (compatible; grok-agent/1.0; +https://x.ai)6
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.365
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.364
RankPulseBot/0.1 (+https://github.com/rankpulse/rankpulse)2
NFHN Reader (https://nfhn.netlify.app)2

Country

fingerprintco-occurrences
US · United States1306
HU · Hungary7
DE · Germany5
RO · Romania3
FI · Finland2
AU · Australia1
NL · Netherlands1
CH · Switzerland1
GB · United Kingdom1
RU · Russia1

Network (ASN)

fingerprintco-occurrences
AS8075 · Microsoft Corporation917
AS16509 · Amazon.com, Inc.376
AS396982 · Google LLC13
AS701 · Verizon Business7
AS213155 · Yettel Hungary Ltd.5
AS9009 · M247 Europe SRL4
AS24940 · Hetzner Online GmbH2
AS38195 · Superloop1
AS43357 · Owl Limited1
AS5483 · Magyar Telekom Plc.1