t12d640400_f559eb9565fd_3549fbaf615c
nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)
What this fingerprint encodes
JA4_a
t12d640400
handshake shape, human-readable
JA4_b
f559eb9565fd
truncated hash of the cipher list
JA4_c
3549fbaf615c
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- TLS 1.2
- Server name
- server name sent
- Cipher suites offered
- 64
- Extensions offered
- 4
- ALPN
- none offered
Same tool, different options
These 5 other fingerprints share this one's JA4_c — the extension and signature-algorithm hash. A client that keeps its extension set constant while varying its cipher list produces exactly this pattern, which is what a scanner iterating cipher suites looks like. A JA3 cannot show you this: its single MD5 collapses ciphers and extensions together, so every variation looks like an unrelated client.