JA4 Fingerprinting

The JA4 fingerprint is a 12-character string composed of four distinct fields separated by underscores: JA4 = PROTO_TLS_CIPHER_EXT.

• PROTO: Indicates the TLS version (e.g., t13 for TLS 1.3, t12 for TLS 1.2).
• TLS: A hash of the ordered list of cipher suites.
• CIPHER: A hash of the ordered list of TLS extensions.
• EXT: A hash of the ALPN (Application-Layer Protocol Negotiation) values. This structured format allows for rapid, human-readable comparison and grouping of similar client behaviors.

A critical innovation of JA4 over its predecessor JA3 is the mandatory sorting of cipher suites and extensions before hashing.

• JA3 generated different fingerprints if a client randomized the order of its cipher list, causing fragmentation.
• JA4 enforces a canonical sort order, ensuring that the same logical configuration always produces the same hash. This eliminates a major source of false negatives in threat hunting and asset identification.

The fourth field of the JA4 hash is derived from the Application-Layer Protocol Negotiation (ALPN) extension. This field captures the specific application protocol the client intends to speak.

• A standard web browser will present h2 and http/1.1.
• A malware C2 agent might present a custom or absent ALPN value.
• A Python requests library will have a distinct ALPN signature. This provides a powerful, high-level discriminator for identifying the software category.

Modern TLS libraries, particularly those in browsers, inject GREASE (Generate Random Extensions And Sustain Extensibility) values into the Client Hello.

• These are random, invalid cipher suites and extensions designed to prevent protocol ossification.
• JA4 intelligently filters out known GREASE codes before hashing.
• Without this filtering, every connection from a Chrome browser would produce a unique, useless fingerprint. This filtering is essential for generating a stable, useful identifier.

JA4 fingerprinting is a passive identification technique. It operates by observing the initial unencrypted Client Hello packet in a TCP stream.

• No injection: No packets are sent to the client.
• No decryption: The analysis is performed on the plaintext handshake.
• Minimal latency: The fingerprint is computed in microseconds. This makes it ideal for high-throughput network sensors, IDS/IPS platforms, and Zeek integrations where inline blocking or real-time alerting is required.

JA4 is a cornerstone of modern threat hunting because malware implants and command-and-control (C2) frameworks use distinct TLS libraries with unique, hard-coded configurations.

• Cobalt Strike beacons have a characteristic set of cipher suites and extensions.
• Metasploit payloads generate a different, equally identifiable JA4 hash.
• Custom RATs often use outdated or minimal TLS stacks that stand out sharply against a background of standard browser traffic. Security teams maintain threat intelligence feeds of known-malicious JA4 hashes to detect compromised hosts.

The foundational passive identification technique that analyzes Client Hello parameters—including cipher suites, TLS extensions, and elliptic curves—to identify originating software. JA4 is a modern evolution of this concept, replacing legacy methods like JA3 that produced brittle, high-entropy hashes. TLS fingerprinting works regardless of destination IP or payload encryption, making it ideal for detecting malware and scrapers that use custom TLS stacks.

A passive OS identification technique that examines subtle variations in TCP header fields to determine the operating system of a connecting client. Key indicators include:

• Initial Window Size: Varies predictably between Linux, Windows, and macOS
• TTL (Time to Live): Default values differ by OS
• TCP Options Ordering: The sequence and presence of options like MSS, SACK, and window scaling
• Don't Fragment Bit Behavior: Handling differs across stacks

Combined with JA4, TCP/IP fingerprinting provides multi-layer identification that resists spoofing.

A stateless identification method that aggregates unique device attributes to generate a stable identifier. Unlike JA4 which operates at the transport layer, browser fingerprinting works at the application layer by probing:

• Canvas rendering and WebGL capabilities
• Installed fonts and plugin enumerations
• AudioContext signal processing artifacts
• Screen resolution and color depth

Browser fingerprinting is effective against headless browsers like Puppeteer and Selenium that JA4 alone cannot distinguish from legitimate Chrome instances.

A comprehensive security discipline that integrates multiple signals—including JA4 hashes, behavioral analysis, and IP reputation—to classify automated traffic. Modern bot management platforms use machine learning to correlate JA4 fingerprints with:

• Request velocity and inter-request timing
• Navigation flow anomalies and session patterns
• JavaScript challenge pass/fail rates
• CAPTCHA interaction telemetry

JA4 provides the cryptographic identity layer, while behavioral analysis determines intent. Together they enable surgical blocking of malicious automation without impacting legitimate API consumers.

An advanced network filtering method that examines payload data beyond basic headers to identify scraping tools using protocol-specific signatures. While JA4 operates on the unencrypted Client Hello handshake, DPI can:

• Decrypt and inspect TLS traffic when deployed with SSL bump proxies
• Detect HTTP/2 and HTTP/3 fingerprinting artifacts in application data
• Identify proprietary API client signatures embedded in request bodies

DPI complements JA4 by providing visibility into encrypted payloads, though it introduces latency and privacy compliance concerns that passive JA4 fingerprinting avoids.

A machine learning approach that establishes a baseline of normal traffic and flags statistical deviations indicative of scraping activity. JA4 fingerprints serve as a critical feature in anomaly models by:

• Clustering traffic by client implementation rather than IP
• Detecting new JA4 hashes that deviate from known legitimate client profiles
• Identifying JA4 rotation patterns where scrapers cycle through TLS implementations
• Correlating JA4 with request volume spikes to distinguish organic traffic surges from automated campaigns

This statistical layer transforms JA4 from a static blocklist into a dynamic threat detection system.