User-Agent

Good

first seen 2026-08-01 07:31 · last seen 2026-09-22 12:08 · JSON

Decomposed attributes

Browser / clientGood
Noteinferred from the self-declared string — a claim, not a measurement; compare with the wire fingerprints above

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
q13d0311h3_55b375c5d22e_0e9637bee5d37
t13d2014h2_a09f3c656075_14788d8d241b4
t12d091100_08d6d9b33cd7_6d6c278f61f23
t13d2014h2_a09f3c656075_a5b99884f7f53
t12d091100_08d6d9b33cd7_3cea1dfb92aa2

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn05zhcn_eff5d0107a3f_000000000000_0000000000007
ge30nn06zhcn_efcfe334972b_000000000000_0000000000007
ge11nn060000_928b7c31c81a_000000000000_0000000000005

HTTP/2 frames (Akamai)

fingerprintco-occurrences
4:2097152;3:100|10485760|0|m,s,p,a7

TCP SYN (p0f)

fingerprintco-occurrences
4:49+15:0:1380:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:03
4:241+14:0:1460:65535,0:mss:df,id+:03
4:47+17:0:1380:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:02
4:115+13:0:1400:65535,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:48+16:0:1380:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:01
4:242+13:0:1460:65535,0:mss:df,id+:01
6:49+15:0:1300:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:flow:01

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-1-3-1-1-8-4-0-0_1380_66
65535_2_1460_004
65535_2-1-3-1-1-4_1400_81
65535_2-1-3-1-1-8-4-0-0_1300_61

QUIC transport params

fingerprintco-occurrences
q07_e80dd4933807 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, urlsession 6.3.3, safari 26.6.2, +2 more.The fingerprint page shows the full measured match list. More on the catalog.7

Country

fingerprintco-occurrences
CN · China14
SG · Singapore5

Network (ASN)

fingerprintco-occurrences
AS4812 · China Telecom (Group)14
AS141389 · GOIP Telecom (Asia Pacific) Pte. Ltd.5