TLS ClientHello (JA4)

t13d1713h1_ab0a1bf427ad_89ab6efea773

first seen 2026-07-02 10:04 · last seen 2026-09-16 10:57 · JSON

Last 7 days (2 observations)

Distinct clients per day (last 30 days, peak 3/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Protocolt (TLS over TCP)
TLS version13
SNId (domain)
Cipher count17
Extension count13
ALPNh1
Ciphers0067, 006b, 009e, 009f, 1301, 1302, 1303, c023, c024, c027, c028, c02b, c02c, c02f, c030, cca8, cca9
Extensions000a, 000b, 000d, 0016, 0017, 0023, 002b, 002d, 0031, 0033, ff01
Signature algorithms0905, 0906, 0904, 0403, 0503, 0603, 0807, 0808, 081a, 081b, 081c, 0809, 080a, 080b, 0804, 0805, 0806, 0401, 0501, 0601, 0303, 0301, 0302, 0402, 0502, 0602
JA4_rt13d1713h1_0067,006b,009e,009f,1301,1302,1303,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0016,0017,0023,002b,002d,0031,0033,ff01_0905,0906,0904,0403,0503,0603,0807,0808,081a,081b,081c,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602
JA4_o (sample)t13d1713h1_fd0eb050439a_ac48044ee426
JA4_ro (sample)t13d1713h1_1302,1303,1301,c02c,c030,c02b,c02f,cca9,cca8,c024,c028,c023,c027,009f,009e,006b,0067_ff01,0000,000b,000a,0023,0010,0016,0017,0031,000d,002b,002d,0033_0905,0906,0904,0403,0503,0603,0807,0808,081a,081b,081c,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn050000_ea6f06182064_000000000000_00000000000028
ge11nn040000_5b1e8b5f4d2d_000000000000_0000000000003
ge11nn06enus_98e697c2fa06_000000000000_0000000000002
po11nn060000_f35f2e0a87d7_000000000000_0000000000002
ge11nn06en00_98e697c2fa06_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
6:54+10:0:1376:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:flow:014
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:03
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:03
6:46+18:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:03
6:47+17:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:03
6:45+19:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:02
4:44+20:0:1460:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:02
6:45+19:0:1440:mss*30,9:mss,sok,ts,nop,ws:flow:02
4:55+9:0:1460:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:01
4:108+20:0:1360:mss*44,8:mss,nop,ws,nop,nop,sok::01

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-1-3-1-1-8-4-0-0_1376_614
64800_2-4-8-1-3_1440_78
64240_2-4-8-1-3_1460_76
65535_2-1-3-1-1-8-4-0-0_1460_63
43200_2-4-8-1-3_1440_92
64240_2-1-3-1-1-4_1360_81
65535_2-1-3-1-1-8-4-0-0_1230_61
64240_2-1-3-1-1-4_1436_81

User-Agent

fingerprintco-occurrences
DivisionAthenaOfficialFundingNews/0.1 public no-cookie runner14
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124 Safari/537.3612
Mozilla/5.0 (lars-studio)2
TopicResearchCollector/0.1 (academic-topic-research)2
Python-urllib/3.142
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.361
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/124 Safari/5371

Country

fingerprintco-occurrences
US · United States29
JP · Japan2
LT · Lithuania2
AU · Australia1
NL · Netherlands1
IN · India1

Network (ASN)

fingerprintco-occurrences
AS213230 · Hetzner Online GmbH14
AS21928 · T-Mobile USA, Inc.14
AS63949 · Akamai Connected Cloud2
AS202412 · Omegatech LTD2
AS21412 · UAB Cgates2
AS4764 · Aussie Fibre Pty Ltd1
AS24560 · Bharti Airtel Ltd., Telemedia Services1