{ "donate": "tls_collect local collector", "ip": "216.73.217.60:22716", "http_version": "h2", "method": "GET", "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)", "tls": { "sni": "tlsnb.com", "alpn": [ "h2", "http/1.1" ], "ciphers": [ "TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "0x00ff" ], "cipher_ids": [ 4866, 4865, 4867, 49196, 49195, 52393, 49200, 49199, 52392, 255 ], "extensions": [ { "id": 10, "name": "supported_groups (10)", "length": 8, "supported_groups": [ "X25519", "P-256", "P-384" ] }, { "id": 16, "name": "application_layer_protocol_negotiation (16)", "length": 14, "protocols": [ "h2", "http/1.1" ] }, { "id": 35, "name": "session_ticket (35)", "length": 0 }, { "id": 51, "name": "key_share (51)", "length": 38, "shared_key_groups": [ "X25519" ], "shared_keys": [ { "X25519": "33a50251b4ba35f03140deb78a728193aa10c970831299762a4fdba9cffe6505" } ] }, { "id": 43, "name": "supported_versions (43)", "length": 5, "versions": [ "TLS 1.3", "TLS 1.2" ] }, { "id": 0, "name": "server_name (0)", "length": 14, "server_name": "tlsnb.com" }, { "id": 45, "name": "psk_key_exchange_modes (45)", "length": 2, "psk_key_exchange_modes": [ 1 ], "PSK_Key_Exchange_Mode": "PSK with (EC)DHE key establishment (psk_dhe_ke) (1)" }, { "id": 5, "name": "status_request (5)", "length": 5 }, { "id": 13, "name": "signature_algorithms (13)", "length": 20, "signature_algorithms": [ "ecdsa_secp384r1_sha384", "ecdsa_secp256r1_sha256", "0x0807", "rsa_pss_rsae_sha512", "rsa_pss_rsae_sha384", "rsa_pss_rsae_sha256", "rsa_pkcs1_sha512", "rsa_pkcs1_sha384", "rsa_pkcs1_sha256" ] }, { "id": 23, "name": "extended_master_secret (23)", "length": 0 }, { "id": 11, "name": "ec_point_formats (11)", "length": 2, "elliptic_curves_point_formats": [ "0x00" ] } ], "extension_ids": [ 10, 16, 35, 51, 43, 0, 45, 5, 13, 23, 11 ], "tls_version_record": "769", "tls_version_client_hello": "771", "tls_version_negotiated": "772", "supported_versions": [ "TLS 1.3", "TLS 1.2" ], "ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-16-35-51-43-0-45-5-13-23-11,29-23-24,0", "ja3_hash": "9cdc2f35c4437dd7dea973c5eb2bd5f3", "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3", "ja4_o": "t13d1011h2_b9b30c653583_0f6f5c3bdba4", "ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401", "ja4_ro": "t13d1011h2_1302,1301,1303,c02c,c02b,cca9,c030,c02f,cca8,00ff_000a,0010,0023,0033,002b,0000,002d,0005,000d,0017,000b_0503,0403,0807,0806,0805,0804,0601,0501,0401", "peetprint": "772-771|h2-http/1.1|29-23-24|1283-1027-2055-2054-2053-2052-1537-1281-1025|0||4866-4865-4867-49196-49195-52393-49200-49199-52392-255|10-16-35-51-43-0-45-5-13-23-11", "peetprint_hash": "ab95cec76b6a607979b053c693416a83", "client_random": "d6e7bc926fabbfd975aa1e84485ffa68b910181bcac34f0d4f0ae3101a7a4da9", "session_id": "cec3b5b1d65c21424a9bc6505d6941258ebf50fd24ccb455a7dbdceda1fb3ac3", "client_hello_len": 254, "session_id_len": 32, "has_grease": false, "has_ech": false, "has_alps": false, "has_cert_compression": false }, "http1": null, "http2": { "akamai_fingerprint": "2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p", "akamai_fingerprint_hash": "9b5dcd077a77c5e324b91d8cc306fd5a", "sent_frames": [ { "frame_type": "SETTINGS", "length": 24, "flags": [], "stream_id": 0, "settings": [ "ENABLE_PUSH = 0", "INITIAL_WINDOW_SIZE = 2097152", "MAX_FRAME_SIZE = 16384", "MAX_HEADER_LIST_SIZE = 16384" ] }, { "frame_type": "WINDOW_UPDATE", "length": 4, "flags": [], "stream_id": 0, "increment": 5177345 }, { "frame_type": "HEADERS", "length": 124, "flags": [ "END_STREAM", "END_HEADERS" ], "stream_id": 1, "headers": [ ":method: GET", ":scheme: https", ":authority: tlsnb.com", ":path: /api/all", "accept: */*", "user-agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)", "accept-encoding: gzip, br, zstd, deflate" ] } ], "pseudo_header_order": [ ":method", ":scheme", ":authority", ":path" ], "regular_header_order": [ "accept", "user-agent", "accept-encoding" ], "headers": [ ":method: GET", ":scheme: https", ":authority: tlsnb.com", ":path: /api/all", "accept: */*", "user-agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)", "accept-encoding: gzip, br, zstd, deflate" ], "priority": null }, "tcpip": { "available": true, "src_ip": "216.73.217.60", "src_port": 22716, "dst_ip": "172.19.0.9", "dst_port": 443, "ip_version": 4, "observed_ttl": 108, "inferred_initial_ttl": 128, "hop_distance": 20, "syn": { "mss": 1424, "window_size": 62727, "window_scale": 7, "sack_permitted": true, "timestamps": true, "timestamp_value": 3642367154, "timestamp_echo": 0, "options_order": [ "MSS", "SACK_PERM", "TS", "NOP", "WS" ], "option_kinds": [ 2, 4, 8, 1, 3 ], "tcp_header_len": 40, "ip_total_len": 60, "df": true }, "captured_at_unix_ms": 1785682119058, "note": "Captured from TCP SYN using Linux AF_PACKET.", "os_guess": { "family": "Windows", "confidence": 0.55, "basis": [ "initial_ttl=128" ] } }, "request": { "request_id": "3a85b1d1-8dfe-4508-a5ea-374df79f7460", "timestamp_unix_ms": 1785682119265, "client_ip": "216.73.217.60", "client_port": 22716, "server_ip": "172.19.0.9", "server_port": 443, "method": "GET", "path": "/api/all", "http_version": "h2", "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)" }, "headers": { "accept": "*/*", "user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)", "accept-encoding": "gzip, br, zstd, deflate" }, "dns": { "available": false, "note": "DNS correlation requires authoritative DNS logs or a unique subdomain challenge." }, "js_env": { "available": false, "note": "JS environment collection will be added by /fp.js in a later phase." }, "fingerprint_keys": { "tls_profile_key": "1541f4d8ba5a8092", "tls_order_key": "6545708f56208a36", "h2_profile_key": "04ba0f2d1fb23645", "header_order_key": "80b089f68b8e87e6", "chrome_feature_key": "1062e53e05a520b9", "tls_profile_text": "ja4=t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3|alpn=h2,http/1.1|versions=TLS 1.3,TLS 1.2|groups=X25519,P-256,P-384|keyshare=X25519|ech=0|alps=0|certcomp=0|grease=0", "tls_order_text": "t13d1011h2_1302,1301,1303,c02c,c02b,cca9,c030,c02f,cca8,00ff_000a,0010,0023,0033,002b,0000,002d,0005,000d,0017,000b_0503,0403,0807,0806,0805,0804,0601,0501,0401|9cdc2f35c4437dd7dea973c5eb2bd5f3|ab95cec76b6a607979b053c693416a83|10,16,35,51,43,0,45,5,13,23,11", "h2_profile_text": "akamai=2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p|settings=ENABLE_PUSH = 0,INITIAL_WINDOW_SIZE = 2097152,MAX_FRAME_SIZE = 16384,MAX_HEADER_LIST_SIZE = 16384|window=5177345|pseudo=:method,:scheme,:authority,:path|regular=accept,user-agent,accept-encoding|priority=none|frames=SETTINGS,WINDOW_UPDATE,HEADERS", "header_order_text": "accept,user-agent,accept-encoding" }, "risk": { "score": 24, "level": "low", "verdict": "likely_browser_or_unknown", "confidence": 0.55, "reasons": [ { "code": "H2_PSEUDO_HEADER_ORDER_MISMATCH", "severity": "medium", "weight": 10, "message": "HTTP/2 pseudo-header order differs from common Chrome navigation order." }, { "code": "JA4_STABLE_WITH_VARIABLE_ORDER", "severity": "medium", "weight": 14, "message": "Short-window observations show stable JA4 capability set but changing order-sensitive JA3/JA4-O/PeetPrint values." } ], "feature_summary_zh": "当前风险等级为低，命中 2 个特征。主要特征：短时间内同源请求 JA4 能力集合稳定，但 JA3/JA4-O/PeetPrint 等顺序敏感字段变化，疑似 random_ja3 或扩展乱序模拟。；HTTP/2 伪头顺序偏离常见 Chrome 导航请求顺序。", "matched_features_zh": [ { "code": "H2_PSEUDO_HEADER_ORDER_MISMATCH", "severity": "medium", "severity_zh": "中", "weight": 10, "description": "HTTP/2 伪头顺序偏离常见 Chrome 导航请求顺序。" }, { "code": "JA4_STABLE_WITH_VARIABLE_ORDER", "severity": "medium", "severity_zh": "中", "weight": 14, "description": "短时间内同源请求 JA4 能力集合稳定，但 JA3/JA4-O/PeetPrint 等顺序敏感字段变化，疑似 random_ja3 或扩展乱序模拟。" } ], "matched_profiles": [], "fingerprint_reputation": { "available": true, "keys": { "tls_profile_key": "1541f4d8ba5a8092", "tls_order_key": "6545708f56208a36", "h2_profile_key": "04ba0f2d1fb23645", "header_order_key": "80b089f68b8e87e6", "chrome_feature_key": "1062e53e05a520b9", "tls_profile_text": "ja4=t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3|alpn=h2,http/1.1|versions=TLS 1.3,TLS 1.2|groups=X25519,P-256,P-384|keyshare=X25519|ech=0|alps=0|certcomp=0|grease=0", "tls_order_text": "t13d1011h2_1302,1301,1303,c02c,c02b,cca9,c030,c02f,cca8,00ff_000a,0010,0023,0033,002b,0000,002d,0005,000d,0017,000b_0503,0403,0807,0806,0805,0804,0601,0501,0401|9cdc2f35c4437dd7dea973c5eb2bd5f3|ab95cec76b6a607979b053c693416a83|10,16,35,51,43,0,45,5,13,23,11", "h2_profile_text": "akamai=2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p|settings=ENABLE_PUSH = 0,INITIAL_WINDOW_SIZE = 2097152,MAX_FRAME_SIZE = 16384,MAX_HEADER_LIST_SIZE = 16384|window=5177345|pseudo=:method,:scheme,:authority,:path|regular=accept,user-agent,accept-encoding|priority=none|frames=SETTINGS,WINDOW_UPDATE,HEADERS", "header_order_text": "accept,user-agent,accept-encoding" }, "exact_profile": { "sample_count": 0, "real_browser_count": 0, "library_count": 0, "browser_claim_count": 0, "labels": {}, "client_names": {}, "client_types": {}, "example_sample_ids": [] }, "order_profile": { "sample_count": 0, "real_browser_count": 0, "library_count": 0, "browser_claim_count": 0, "labels": {}, "client_names": {}, "client_types": {}, "example_sample_ids": [] } }, "parsed_ua": { "raw": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)", "os": "Unknown", "browser": "Unknown", "version_major": null, "engine": "Unknown" } } }