User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0
first seen 2026-10-03 05:44 · last seen 2026-10-23 07:23 · JSON
Distinct clients per day (last 30 days, peak 1/day)
Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.
Decomposed attributes
| Browser / client | Firefox 157.0 |
|---|---|
| Operating system | Linux x86_64 |
| Device class | desktop |
| Note | inferred from the self-declared string — a claim, not a measurement; compare with the wire fingerprints above |
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
TLS ClientHello (JA4)
| fingerprint | co-occurrences |
|---|---|
t13d1517h2_8daaf6152771_6f4c3a25c801 | 30 |
q13d0315h3_55b375c5d22e_bb76f32061e3 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 156.0, firefox 156.0.1.The fingerprint page shows the full measured match list. More on the catalog. | 24 |
t13d1517h2_8daaf6152771_3cbfd9057e0d Match?Exact match in Thumbprint's published controlled catalog captures: firefox 155.0.1, firefox 154.0, firefox 156.0, +7 more.The fingerprint page shows the full measured match list. More on the catalog. | 16 |
q13d0315h3_55b375c5d22e_dc5437974b47 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 155.0.1, +25 more.The fingerprint page shows the full measured match list. More on the catalog. | 8 |
t13d1516h2_8daaf6152771_14f25f0c9e96 | 6 |
t13d1516h2_8daaf6152771_0c27189014cf Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 155.0.1, firefox 155.0, +4 more.The fingerprint page shows the full measured match list. More on the catalog. | 2 |
HTTP request (JA4H)
HTTP/2 frames (Akamai)
TCP SYN (p0f)
TCP SYN (JA4T)
| fingerprint | co-occurrences |
|---|---|
64860_2-4-8-1-3_1380_10 | 36 |
64440_2-4-8-1-3_1432_7 | 13 |
64240_2-4-8-1-3_1380_10 | 3 |
64240_2-4-8-1-3_1460_10 | 1 |
42340_2-4-8-1-3_1460_11 | 1 |
QUIC transport params
| fingerprint | co-occurrences |
|---|---|
q13_c3e7031b10dc Match?Exact match in Thumbprint's published controlled catalog captures: firefox 155.0.1, firefox 156.0, firefox 155.0, +5 more.The fingerprint page shows the full measured match list. More on the catalog. | 32 |
Country
| fingerprint | co-occurrences |
|---|---|
PL · Poland | 60 |
CA · Canada | 16 |
DK · Denmark | 7 |
AU · Australia | 1 |
DE · Germany | 1 |
RU · Russia | 1 |
Network (ASN)
| fingerprint | co-occurrences |
|---|---|
AS16276 · OVH SAS | 60 |
AS1403 · EBOX | 16 |
AS3292 · TDC Holding A/S | 7 |
AS60729 · Stiftung Erneuerbare Freiheit | 1 |
AS136557 · Host Universal Pty Ltd | 1 |
AS41733 · JSC ER-Telecom Holding | 1 |
TLS supported groups
| fingerprint | co-occurrences |
|---|---|
11ec,001d,0017,0018,0019 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 157.0.1, firefox-esr 153.5.1esr, firefox 158.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog. | 2 |
Cross-transport links
TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).