User-Agent

Mozilla/5.0 (compatible; grok-agent/1.0; +https://x.ai)

first seen 2026-08-22 14:37 · last seen 2026-09-24 11:40 · JSON

Decomposed attributes

Browser / client	`grok-agent 1.0`
Device class	`bot`
Declared URL	`https://x.ai`
Note	`inferred from the self-declared string — a claim, not a measurement; compare with the wire fingerprints above`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28.The fingerprint page shows the full measured match list. More on the catalog.	6
`t13d1011h2_61a7ad8aa9b6_f9531d972513` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.13.4, rust-hyper 1.11.0, rust-hyper 1.11.1, +1 more.The fingerprint page shows the full measured match list. More on the catalog.	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nn04enus_39a3ba4480e8_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2.The fingerprint page shows the full measured match list. More on the catalog.	7

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`2:0;4:2097152;5:16384;6:16384\|5177345\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.13.5, rust-reqwest 0.13.4, +4 more.The fingerprint page shows the full measured match list. More on the catalog.	7

TCP SYN (p0f)

fingerprint	co-occurrences
`6:236+19:0:1312:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:flow:0`	2
`4:114+14:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0`	1
`6:235+20:0:1312:65535,6:mss,nop,ws,sok,eol+1:flow:0`	1
`6:235+20:0:1312:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:flow:0`	1
`4:50+14:0:1360:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:id-,ecn:0`	1
`4:43+21:0:1452:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df,ecn:0`	1

TCP SYN (JA4T)

fingerprint	co-occurrences
`65535_2-1-3-1-1-8-4-0-0_1312_6`	3
`65535_2-1-3-1-1-4_1460_8`	1
`65535_2-1-3-1-1-8-4-0-0_1452_6`	1
`65535_2-1-3-1-1-8-4-0-0_1360_6`	1
`65535_2-1-3-4-0-0_1312_6`	1

Country

fingerprint	co-occurrences
`HU` · Hungary	6
`RU` · Russia	1

Network (ASN)

fingerprint	co-occurrences
`AS213155` · Yettel Hungary Ltd.	5
`AS5483` · Magyar Telekom Plc.	1
`AS51604` · JSC ER-Telecom Holding	1