This is your knock.

Everything below was read off this one connection. The source IP, GeoIP city, and JA4 are kept per visit, and the page runs a small script (a sidecar fetch and a copy-to-clipboard handler). Nothing was set in your browser.

you are visitor 1. 2 knocks registered; 2 keyed entries kept.

Network

ASN / ISPAS16509 Amazon.com, Inc.

TLS

JA4tls12_10_11_496f014c18a0

ClientHello versionTLS 1.2

Cipher suites10 offered

GREASE ciphers0x13030xc030

Cipher namesTLS_AES_256_GCM_SHA384TLS_AES_128_GCM_SHA256TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA2560x00FF

Extension order0x002b · 0x0017 · 0x000d · 0x0000 · 0x0005 · 0x000b · 0x0010 · 0x000a · 0x0023 · 0x0033 · 0x002d

Negotiated versionTLS 1.3

Negotiated cipherTLS_CHACHA20_POLY1305_SHA256

ALPNh2

SNIproksimity.proksiabel.ee

ClientHello bytes269

HTTP/2 — as negotiated

SETTINGSENABLE_PUSH=0 · INITIAL_WINDOW_SIZE=2097152 · MAX_FRAME_SIZE=16384 · MAX_HEADER_LIST_SIZE=16384

SETTINGS orderENABLE_PUSH → INITIAL_WINDOW_SIZE → MAX_FRAME_SIZE → MAX_HEADER_LIST_SIZE

Pseudo-header order:method → :scheme → :authority → :path

Header orderaccept → user-agent → accept-encoding

PRIORITY framesnone sent by this client

HTTP/1.1 — via sidecar

Header ordersidecar not yet reached — reload to unmask (browser opened h2 first)

Non-lowercase casingsidecar not yet reached

QUIC / H3

QUIC Initialno QUIC Initial observed from this address (browsers probe, then fall back to TCP)

Not observed here

WebSocket timingmasked — no socket opened (that is the first-party beacon's job)

Behavioral / circadianmasked — needs a session, and none is kept

Absence is shown as masked, never guessed or filled in. JA4 here is this repository's ComputeJA4 (sorted ciphers and extensions, SHA-256 truncated to 12 hex) — not the canonical FoxIO JA4 string. QUIC observation is read-only: we never complete the H3 handshake. Single connection, single request: no linking, no identity claim, no verdict. A relay with its own TLS stack shows a different knock from the browser behind it; one that copies the browser's stack does not, and our own bench record of 2026-09-22 says so.

copied