{
  "schema_version": 1,
  "observed_at": "2026-08-10T01:53:25.579125571Z",
  "source": "sensor",
  "client": {
    "ip": "216.73.217.52",
    "port": 55676,
    "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
    "http_version": "HTTP/2",
    "sni": "fingerprints2.ellio.tech",
    "host": "fingerprints2.ellio.tech"
  },
  "fingerprints": {
    "muonfp": {
      "value": "62727:2-4-8-1-3:1460:7",
      "raw": "62727:2-4-8-1-3:1460:7"
    },
    "ja4": {
      "value": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
      "raw": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
      "variants": {
        "o": "t13d1011h2_b9b30c653583_cc4575a0bd88",
        "ro": "t13d1011h2_1302,1301,1303,c02c,c02b,cca9,c030,c02f,cca8,00ff_0017,0033,000a,002b,0005,0010,000d,000b,002d,0000,0023_0503,0403,0807,0806,0805,0804,0601,0501,0401"
      },
      "interop": [
        {
          "id": "extension-count-from-hashed-list",
          "title": "Extension count taken from the hashed list",
          "ja4": "t13d1009h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1009h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": false,
          "spec_rule": "Number of Extensions: Same as counting ciphers. Ignore GREASE. Include SNI and ALPN.",
          "how_it_arises": "JA4 builds the c-section list by sorting the extensions and removing SNI (0x0000) and ALPN (0x0010), which holds that hash steady when a client switches between a domain and an IP or changes the protocols it offers. The a-section count is taken over a different set: every non-GREASE extension, the two removed ones included. An implementation that reuses the length of the sorted list for the count reports two extensions fewer, turning t13d3112h2_e8f1e7e78f70_b26ce05bbdd6 into t13d3110h2_e8f1e7e78f70_b26ce05bbdd6 with both hashes intact."
        },
        {
          "id": "padding-omitted-from-hash",
          "title": "Padding extension omitted from the c-section",
          "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": true,
          "spec_rule": "Ignore the SNI extension (0000) and the ALPN extension (0010) ... These values are omitted so that the same application would have the same c section.",
          "how_it_arises": "The padding extension (0x0015) carries no value of its own and its length tracks the size of the ClientHello, so an implementation reading for stability treats it as transport noise and drops it from the c-section list. The specification removes exactly two extensions, SNI (0x0000) and ALPN (0x0010), because the a-section already reports both; whether a client pads at all is a property of its TLS stack. The extension count is untouched and the c-section moves: b26ce05bbdd6 becomes 375ca2c5e164."
        },
        {
          "id": "padding-omitted-everywhere",
          "title": "Padding extension omitted from both the count and the c-section",
          "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": true,
          "spec_rule": "Number of Extensions: ... Ignore GREASE. Include SNI and ALPN.",
          "how_it_arises": "An implementation that treats padding (0x0015) as noise in the c-section has the same reason to keep it out of the extension count, and applying the rule at both sites is the more consistent of the two padding readings. The specification counts every non-GREASE extension, padding included. Both sections move: t13d3112h2_e8f1e7e78f70_b26ce05bbdd6 becomes t13d3111h2_e8f1e7e78f70_375ca2c5e164."
        },
        {
          "id": "ephemeral-extensions-stripped",
          "title": "Padding, session_ticket and pre_shared_key removed to stabilise the fingerprint",
          "ja4": "t13d1010h2_61a7ad8aa9b6_6a7d638fc319",
          "ja4_r": "t13d1010h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": false,
          "spec_rule": "Ignore the SNI extension (0000) and the ALPN extension (0010) ... (notice 0000 and 0010 is removed)",
          "how_it_arises": "Padding (0x0015) varies with the size of the ClientHello, and session_ticket (0x0023) and pre_shared_key (0x0029) appear only when a client resumes, so one library produces several conformant JA4 values depending on what it is doing at the time: a cold handshake and a resumed one differ while the software is identical. Several implementations remove all three, which collapses that set to one value per library. This is a deliberate convention rather than a misreading: the specification's authors kept the three extensions in on purpose, treat the variation as signal about what the client is doing, and have floated a separate opt-in variant instead of changing JA4 (FoxIO-LLC/ja4 issue #303). All four reference implementations include them, so a value computed under the convention is comparable only with others computed the same way."
        },
        {
          "id": "signature-algorithms-sorted",
          "title": "Signature algorithms sorted before hashing",
          "ja4": "t13d1011h2_61a7ad8aa9b6_867a6ff6dde3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0401,0403,0501,0503,0601,0804,0805,0806,0807",
          "same_as_conformant": false,
          "spec_rule": "The signature algorithm hex values are then added to the end of the list in the order that they appear (not sorted).",
          "how_it_arises": "The c-section input is the sorted extension list, an underscore, then the signature algorithms; the specification sorts the first list and leaves the second in wire order. An implementation that builds both lists through the same helper sorts both. Wire order is the client's stated preference order and separates stacks that offer identical algorithm sets, so sorting moves the c-section of every client that does not already send them ascending: b26ce05bbdd6 becomes 0c76ac0b1ceb."
        },
        {
          "id": "grease-kept-in-signature-algorithms",
          "title": "GREASE retained in the signature algorithms",
          "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": true,
          "spec_rule": "The program needs to ignore GREASE values anywhere it sees them.",
          "how_it_arises": "RFC 8701 permits GREASE values in the cipher list, in the extension list and inside signature_algorithms (0x000d), and JA4 discards them everywhere. GREASE is conspicuous in the first two lists, so a filter written where it first shows up can miss the third. The reference implementations split on this point as well (FoxIO-LLC/ja4 issue #305): a client that offers GREASE signature algorithms gets one c-section from the implementations that filter them and another from those that do not."
        },
        {
          "id": "counts-not-zero-padded",
          "title": "Cipher and extension counts not zero-padded",
          "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": true,
          "spec_rule": "2 character count of ciphers, so if there's 6 cipher suites in the hello packet, then the value should be 06.",
          "how_it_arises": "Both counts in the a-section are two characters wide: six cipher suites render as 06. An implementation that formats the integer without an explicit width writes 6, which never shows on browser traffic because browsers offer ten or more ciphers and ten or more extensions. It shows on minimal clients such as scanners, embedded stacks and hand-rolled TLS, where the a-section is no longer ten characters and parsers that slice it by offset read the wrong fields."
        },
        {
          "id": "alpn-omitted-when-absent",
          "title": "ALPN characters omitted when there is no ALPN extension",
          "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": true,
          "spec_rule": "If there is no ALPN extension, no ALPN values, or the first ALPN value is empty, then we print 00 as the value in the fingerprint.",
          "how_it_arises": "A ClientHello with no ALPN extension, no protocols inside it, or an empty first protocol takes the literal 00 as the last two characters of the a-section. An implementation that assembles the a-section by concatenation writes an empty string instead, and the result still looks well formed. The a-section then runs to eight characters rather than ten: t13d311200_e8f1e7e78f70_b26ce05bbdd6 is emitted as t13d3112_e8f1e7e78f70_b26ce05bbdd6."
        },
        {
          "id": "alpn-first-two-characters",
          "title": "ALPN rendered from its first two characters instead of first and last",
          "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": true,
          "spec_rule": "The first and last ASCII alphanumeric characters of the ALPN (Application-Layer Protocol Negotiation) first value ... If the first ALPN listed was http/1.1 then the first and last characters to use in the fingerprint would be h1.",
          "how_it_arises": "The a-section takes the first and last ASCII alphanumeric characters of the first ALPN value, so http/1.1 renders as h1. Taking the first two characters instead agrees with that rule for every two-character value, including the h2 that nearly all TLS traffic offers first. The two rules separate on longer values: t13d3112h1_e8f1e7e78f70_b26ce05bbdd6 is emitted as t13d3112ht_e8f1e7e78f70_b26ce05bbdd6, and protocol names sharing a prefix, http/1.0 and http/1.1 among them, stop being distinguishable."
        },
        {
          "id": "version-from-legacy-field",
          "title": "TLS version read from the ClientHello version field",
          "ja4": "t12d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t12d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": false,
          "spec_rule": "If extension 0x002b exists (supported_versions), then the version is the highest value in the extension.",
          "how_it_arises": "supported_versions (0x002b) carries the versions a client will actually accept, and JA4 takes the highest non-GREASE value in it whenever the extension is present. A TLS 1.3 client pins legacy_version to 0x0303 for middlebox compatibility, so an implementation that reads that field reports every modern client as TLS 1.2: t13d3112h2_e8f1e7e78f70_b26ce05bbdd6 becomes t12d3112h2_e8f1e7e78f70_b26ce05bbdd6. Substituting the negotiated version skews the other way and makes the fingerprint depend on the server the client reached."
        },
        {
          "id": "signature-algorithms-over-collected",
          "title": "Signature algorithms collected from every extension that carries them",
          "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
          "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
          "same_as_conformant": true,
          "spec_rule": "the list of extensions ... followed by the list of signature algorithms.",
          "how_it_arises": "Three extensions carry signature algorithm lists: signature_algorithms (0x000d), signature_algorithms_cert (0x0032) and delegated_credentials (0x0022). JA4 appends the contents of 0x000d and nothing else. A parser that gathers every signature algorithm it decodes appends the other two lists as well and lengthens the c-section input, which moves the c-section for the clients that send those extensions and leaves the rest untouched (FoxIO-LLC/ja4 issue #41)."
        }
      ]
    },
    "ja3": {
      "value": "8cbc868edb362e6b62d40fe979739dac",
      "raw": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-51-10-43-5-16-13-11-45-0-35,29-23-24,0",
      "hash": "8cbc868edb362e6b62d40fe979739dac"
    },
    "ja3n": {
      "value": "24dd0f987266c37f39231f6f2130d12e",
      "raw": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,0-5-10-11-13-16-23-35-43-45-51,29-23-24,0",
      "hash": "24dd0f987266c37f39231f6f2130d12e"
    },
    "akamai": {
      "value": "2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p",
      "raw": "2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p",
      "hash": "9b5dcd077a77c5e324b91d8cc306fd5a"
    },
    "ja4h": {
      "value": "ge20nn030000_80b089f68b8e_000000000000_000000000000",
      "raw": "ge20nn030000_accept,user-agent,accept-encoding_",
      "variants": {
        "o": "ge20nn030000_80b089f68b8e_000000000000_000000000000",
        "ro": "ge20nn030000_accept,user-agent,accept-encoding_"
      }
    }
  },
  "tls": {
    "transport": "tcp",
    "record_version": {
      "value": 769,
      "hex": "0x0301",
      "name": "TLS 1.0"
    },
    "legacy_version": {
      "value": 771,
      "hex": "0x0303",
      "name": "TLS 1.2"
    },
    "supported_versions": [
      {
        "value": 772,
        "hex": "0x0304",
        "name": "TLS 1.3"
      },
      {
        "value": 771,
        "hex": "0x0303",
        "name": "TLS 1.2"
      }
    ],
    "highest_supported_version": {
      "value": 772,
      "hex": "0x0304",
      "name": "TLS 1.3"
    },
    "server_name": "fingerprints2.ellio.tech",
    "has_sni": true,
    "alpn": [
      "h2",
      "http/1.1"
    ],
    "has_alpn": true,
    "session_id_length": 32,
    "cipher_suites": [
      {
        "value": 4866,
        "hex": "0x1302",
        "name": "TLS_AES_256_GCM_SHA384"
      },
      {
        "value": 4865,
        "hex": "0x1301",
        "name": "TLS_AES_128_GCM_SHA256"
      },
      {
        "value": 4867,
        "hex": "0x1303",
        "name": "TLS_CHACHA20_POLY1305_SHA256"
      },
      {
        "value": 49196,
        "hex": "0xc02c",
        "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
      },
      {
        "value": 49195,
        "hex": "0xc02b",
        "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
      },
      {
        "value": 52393,
        "hex": "0xcca9",
        "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
      },
      {
        "value": 49200,
        "hex": "0xc030",
        "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
      },
      {
        "value": 49199,
        "hex": "0xc02f",
        "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
      },
      {
        "value": 52392,
        "hex": "0xcca8",
        "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
      },
      {
        "value": 255,
        "hex": "0x00ff",
        "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
      }
    ],
    "extensions": [
      {
        "value": 23,
        "hex": "0x0017",
        "name": "extended_master_secret"
      },
      {
        "value": 51,
        "hex": "0x0033",
        "name": "key_share"
      },
      {
        "value": 10,
        "hex": "0x000a",
        "name": "supported_groups"
      },
      {
        "value": 43,
        "hex": "0x002b",
        "name": "supported_versions"
      },
      {
        "value": 5,
        "hex": "0x0005",
        "name": "status_request"
      },
      {
        "value": 16,
        "hex": "0x0010",
        "name": "application_layer_protocol_negotiation"
      },
      {
        "value": 13,
        "hex": "0x000d",
        "name": "signature_algorithms"
      },
      {
        "value": 11,
        "hex": "0x000b",
        "name": "ec_point_formats"
      },
      {
        "value": 45,
        "hex": "0x002d",
        "name": "psk_key_exchange_modes"
      },
      {
        "value": 0,
        "hex": "0x0000",
        "name": "server_name"
      },
      {
        "value": 35,
        "hex": "0x0023",
        "name": "session_ticket"
      }
    ],
    "compression_methods": [
      {
        "value": 0,
        "hex": "0x0000",
        "name": "null"
      }
    ],
    "supported_groups": [
      {
        "value": 29,
        "hex": "0x001d",
        "name": "x25519"
      },
      {
        "value": 23,
        "hex": "0x0017",
        "name": "secp256r1"
      },
      {
        "value": 24,
        "hex": "0x0018",
        "name": "secp384r1"
      }
    ],
    "ec_point_formats": [
      {
        "value": 0,
        "hex": "0x0000",
        "name": "uncompressed"
      }
    ],
    "signature_algorithms": [
      {
        "value": 1283,
        "hex": "0x0503",
        "name": "ecdsa_secp384r1_sha384"
      },
      {
        "value": 1027,
        "hex": "0x0403",
        "name": "ecdsa_secp256r1_sha256"
      },
      {
        "value": 2055,
        "hex": "0x0807",
        "name": "ed25519"
      },
      {
        "value": 2054,
        "hex": "0x0806",
        "name": "rsa_pss_rsae_sha512"
      },
      {
        "value": 2053,
        "hex": "0x0805",
        "name": "rsa_pss_rsae_sha384"
      },
      {
        "value": 2052,
        "hex": "0x0804",
        "name": "rsa_pss_rsae_sha256"
      },
      {
        "value": 1537,
        "hex": "0x0601",
        "name": "rsa_pkcs1_sha512"
      },
      {
        "value": 1281,
        "hex": "0x0501",
        "name": "rsa_pkcs1_sha384"
      },
      {
        "value": 1025,
        "hex": "0x0401",
        "name": "rsa_pkcs1_sha256"
      }
    ],
    "psk_key_exchange_modes": [
      {
        "value": 1,
        "hex": "0x0001",
        "name": "psk_dhe_ke"
      }
    ],
    "key_shares": [
      {
        "group": {
          "value": 29,
          "hex": "0x001d",
          "name": "x25519"
        },
        "key_length": 32
      }
    ],
    "has_early_data": false,
    "grease": false,
    "negotiated": {
      "version": {
        "value": 772,
        "hex": "0x0304",
        "name": "TLS 1.3"
      },
      "cipher_suite": {
        "value": 4865,
        "hex": "0x1301",
        "name": "TLS_AES_128_GCM_SHA256"
      },
      "alpn": "h2",
      "server_name": "fingerprints2.ellio.tech",
      "resumed": false
    }
  },
  "http": {
    "method": "GET",
    "version": "2",
    "target": "/api/v1/fingerprint",
    "headers": [
      {
        "name": ":method",
        "value": "GET",
        "pseudo": true
      },
      {
        "name": ":scheme",
        "value": "https",
        "pseudo": true
      },
      {
        "name": ":authority",
        "value": "fingerprints2.ellio.tech",
        "pseudo": true
      },
      {
        "name": ":path",
        "value": "/api/v1/fingerprint",
        "pseudo": true
      },
      {
        "name": "accept",
        "value": "*/*"
      },
      {
        "name": "user-agent",
        "value": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)"
      },
      {
        "name": "accept-encoding",
        "value": "gzip, br, zstd, deflate"
      }
    ],
    "header_order": [
      "accept",
      "user-agent",
      "accept-encoding"
    ],
    "header_count": 3,
    "has_referer": false,
    "has_cookie": false,
    "h2": {
      "settings": [
        {
          "id": 2,
          "name": "SETTINGS_ENABLE_PUSH",
          "value": 0
        },
        {
          "id": 4,
          "name": "SETTINGS_INITIAL_WINDOW_SIZE",
          "value": 2097152
        },
        {
          "id": 5,
          "name": "SETTINGS_MAX_FRAME_SIZE",
          "value": 16384
        },
        {
          "id": 6,
          "name": "SETTINGS_MAX_HEADER_LIST_SIZE",
          "value": 16384
        }
      ],
      "window_update": 5177345,
      "pseudo_header_order": [
        ":method",
        ":scheme",
        ":authority",
        ":path"
      ],
      "frames": [
        {
          "type": "SETTINGS",
          "stream_id": 0,
          "length": 24
        },
        {
          "type": "WINDOW_UPDATE",
          "stream_id": 0,
          "length": 4
        },
        {
          "type": "HEADERS",
          "stream_id": 1,
          "length": 136,
          "flags": [
            "END_STREAM",
            "END_HEADERS"
          ]
        }
      ]
    }
  },
  "tcp": {
    "source_ip": "216.73.217.52",
    "source_port": 55676,
    "destination_ip": "172.31.16.7",
    "destination_port": 443,
    "ip_version": 4,
    "ttl": 120,
    "ip_id": 32555,
    "tos": 0,
    "window": 62727,
    "options": [
      {
        "kind": 2,
        "name": "MSS",
        "length": 2
      },
      {
        "kind": 4,
        "name": "SACK Permitted",
        "length": 0
      },
      {
        "kind": 8,
        "name": "Timestamps",
        "length": 8
      },
      {
        "kind": 1,
        "name": "NOP",
        "length": 0
      },
      {
        "kind": 3,
        "name": "Window Scale",
        "length": 1
      }
    ],
    "breakdown": {
      "window_size": 62727,
      "tcp_options": "2-4-8-1-3",
      "mss": "1460",
      "window_scale": "7",
      "options_explained": [
        "2 (MSS)",
        "4 (SACK Permitted)",
        "8 (Timestamps)",
        "1 (NOP)",
        "3 (Window Scale)"
      ]
    }
  }
}