TLS ClientHello (JA4)

q13d0413h3_9caa18292e23_23fce1e67d98

first seen 2026-06-11 00:08 · last seen 2026-09-07 05:57 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocol	`q (QUIC)`
TLS version	`13`
SNI	`d (domain)`
Cipher count	`4`
Extension count	`13`
ALPN	`h3`
Ciphers	`1301, 1302, 1303, 1304`
Extensions	`000a, 000b, 000d, 0016, 0017, 001b, 002b, 002d, 0031, 0033, 0039`
Signature algorithms	`0904, 0905, 0906, 0403, 0503, 0603, 0807, 0808, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601`
JA4_r	`q13d0413h3_1301,1302,1303,1304_000a,000b,000d,0016,0017,001b,002b,002d,0031,0033,0039_0904,0905,0906,0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601`
JA4_o (sample)	`q13d0413h3_fce5854592ef_f74cb1636568`
JA4_ro (sample)	`q13d0413h3_1302,1303,1301,1304_0039,0000,000b,000a,0010,0016,0017,0031,000d,002b,002d,0033,001b_0904,0905,0906,0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprint	co-occurrences
`ge30nn020000_5594a17e7e7e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.18.0.The fingerprint page shows the full measured match list. More on the catalog.	27
`ge30nn030000_042112399351_000000000000_000000000000`	11
`he30nn040000_1d43baa471e0_000000000000_000000000000`	5
`ge30nn040000_1d43baa471e0_000000000000_000000000000`	3
`he30nn020000_5594a17e7e7e_000000000000_000000000000`	2
`ge30nn030000_e501dbe96746_000000000000_000000000000`	2
`he30nn040000_d5ad64e246c5_000000000000_000000000000`	2
`ge30nn050000_96af4b0229e2_000000000000_000000000000`	1
`ge30nn040000_8e4c291dc2f3_000000000000_000000000000`	1
`ge30nn030000_ba3fe9136eb1_000000000000_000000000000`	1

QUIC transport params

fingerprint	co-occurrences
`q08_bae576bf37b0` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.18.0.The fingerprint page shows the full measured match list. More on the catalog.	56

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36`	53
`Thumbprint-Deployment-Verifier/2799514`	1
`Thumbprint-Rotation-Verifier/20260716`	1
`CodexMineVerifier/20260716-h3`	1

Country

fingerprint	co-occurrences
`AU` · Australia	56

Network (ASN)

fingerprint	co-occurrences
`AS38195` · Superloop	56

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprint	linked observations
`t13d4113h2_8ae0994cad11_86f67be995ff`	13