User-Agent

Mozilla/5.0 fake/1

first seen 2026-07-24 10:18 · last seen 2026-07-24 10:23 · JSON

Decomposed attributes

Browser / client	`Mozilla/5.0 fake/1`
Note	`inferred from the self-declared string — a claim, not a measurement; compare with the wire fingerprints above`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d2812h2_257f3020b3a2_cbb9361b6bf9`	5
`t13d1113h2_a1d74fdbe073_b17c474a414d`	3

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nn020000_b89ce445e0b3_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.27.0, go-net/http 1.26.6, +10 more.The fingerprint page shows the full measured match list. More on the catalog.	8

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`1:4096;4:6291456;5:32768\|8388608\|1:0:0:256\|a,s,p,m`	1
`1:65536;2:1;4:131072;5:16384;6:131072\|8388608\|1:0:0:256\|p,a,s,m`	1
`1:65536;2:1;3:10000;4:1048576\|6291456\|1:0:0:256\|m,a,p,s`	1
`1:65536;2:0;3:10000;4:1048576;5:16384;6:131072\|15663105\|1:0:0:256\|a,m,p,s`	1
`1:65536;3:1000;4:131072;5:16384;6:131072\|10485760\|1:0:0:256\|a,s,p,m`	1
`1:4096;4:65535\|10485760\|1:0:0:256\|m,p,s,a`	1
`1:4096;4:65535\|10485760\|3:0:0:256\|m,p,s,a`	1
`1:4096;4:65535\|10485760\|5:0:0:256\|m,p,s,a`	1

TCP SYN (p0f)

fingerprint	co-occurrences
`6:55+9:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0`	8

TCP SYN (JA4T)

fingerprint	co-occurrences
`64800_2-4-8-1-3_1440_7`	8

Country

fingerprint	co-occurrences
`SE` · Sweden	8

Network (ASN)

fingerprint	co-occurrences
`AS214379` · South Park Networks LLC	8